Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-25679 (GCVE-0-2026-25679)
Vulnerability from cvelistv5 – Published: 2026-03-06 21:28 – Updated: 2026-07-02 12:04- CWE-1286 - Improper Validation of Syntactic Correctness of Input
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | net/url |
Affected:
0 , < 1.25.8
(semver)
Affected: 1.26.0-0 , < 1.26.1 (semver) |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 10 |
cpe:/a:redhat:ansible_automation_platform:2.6::el10 cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10 |
|
| Red Hat | Red Hat Enterprise Linux Server (v. 7 ELS) |
cpe:/o:redhat:rhel_els:7 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.12 |
cpe:/a:redhat:openshift:4.12::el8 cpe:/a:redhat:openshift:4.12::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.13 |
cpe:/a:redhat:openshift:4.13::el8 cpe:/a:redhat:openshift:4.13::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.14 |
cpe:/a:redhat:openshift:4.14::el8 cpe:/a:redhat:openshift:4.14::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.16 |
cpe:/a:redhat:openshift:4.16::el8 cpe:/a:redhat:openshift:4.16::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.18 |
cpe:/a:redhat:openshift:4.18::el8 cpe:/a:redhat:openshift:4.18::el9 |
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 |
cpe:/a:redhat:satellite:6.16::el8 cpe:/a:redhat:satellite_capsule:6.16::el8 cpe:/a:redhat:satellite_maintenance:6.16::el8 cpe:/a:redhat:satellite_utils:6.16::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
cpe:/a:redhat:ansible_automation_platform:2.5::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
cpe:/a:redhat:ansible_automation_platform:2.6::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9 |
|
| Red Hat | Cryostat 4 on RHEL 9 |
cpe:/a:redhat:cryostat:4::el9 |
|
| Red Hat | Red Hat OpenStack Platform 17.1 |
cpe:/a:redhat:openstack:17.1 cpe:/a:redhat:openstack:17.1::el9 |
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 |
cpe:/a:redhat:satellite:6.16::el9 cpe:/a:redhat:satellite_capsule:6.16::el9 cpe:/a:redhat:satellite_maintenance:6.16::el9 cpe:/a:redhat:satellite_utils:6.16::el9 |
|
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 |
cpe:/a:redhat:satellite:6.19::el9 cpe:/a:redhat:satellite_capsule:6.19::el9 cpe:/a:redhat:satellite_maintenance:6.19::el9 cpe:/a:redhat:satellite_utils:6.19::el9 |
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS (v. 10.0) |
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 10) |
cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 8) |
cpe:/a:redhat:enterprise_linux:8::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream AUS (v. 8.2) |
cpe:/a:redhat:rhel_aus:8.2::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream AUS (v.8.4) |
cpe:/a:redhat:rhel_aus:8.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) |
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream AUS (v.8.6) |
cpe:/a:redhat:rhel_aus:8.6::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream E4S (v.8.6) |
cpe:/a:redhat:rhel_e4s:8.6::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream TUS (v.8.6) |
cpe:/a:redhat:rhel_tus:8.6::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream E4S (v.8.8) |
cpe:/a:redhat:rhel_e4s:8.8::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream TUS (v.8.8) |
cpe:/a:redhat:rhel_tus:8.8::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream E4S (v.9.0) |
cpe:/a:redhat:rhel_e4s:9.0::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream E4S (v.9.2) |
cpe:/a:redhat:rhel_e4s:9.2::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream E4S (v.9.4) |
cpe:/a:redhat:rhel_e4s:9.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS (v.9.4) |
cpe:/a:redhat:rhel_eus:9.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS (v.9.6) |
cpe:/a:redhat:rhel_eus:9.6::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 9) |
cpe:/a:redhat:enterprise_linux:9::appstream |
|
| Red Hat | Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) |
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) |
cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat CodeReady Linux Builder EUS (v.9.4) |
cpe:/a:redhat:rhel_eus:9.4::crb |
|
| Red Hat | Red Hat CodeReady Linux Builder EUS (v.9.6) |
cpe:/a:redhat:rhel_eus:9.6::crb |
|
| Red Hat | Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) |
cpe:/a:redhat:enterprise_linux:9::crb |
|
| Red Hat | Custom Metric Autoscaler 2.19 |
cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9 |
|
| Red Hat | DevWorkspace Operator 0.4 |
cpe:/a:redhat:devworkspace:0.40::el9 |
|
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.0 |
cpe:/a:redhat:logging:6.0::el9 |
|
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.2 |
cpe:/a:redhat:logging:6.2::el9 |
|
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.4 |
cpe:/a:redhat:logging:6.4::el9 |
|
| Red Hat | Multicluster Global Hub 1.3.4 |
cpe:/a:redhat:multicluster_globalhub:1.3::el9 |
|
| Red Hat | Multicluster Global Hub 1.4.5 |
cpe:/a:redhat:multicluster_globalhub:1.4::el9 |
|
| Red Hat | Multicluster Global Hub 1.5.4 |
cpe:/a:redhat:multicluster_globalhub:1.5::el9 |
|
| Red Hat | Multicluster Global Hub 1.6.2 |
cpe:/a:redhat:multicluster_globalhub:1.6::el9 |
|
| Red Hat | Network Observability (NETOBSERV) 1.11.2 |
cpe:/a:redhat:network_observ_optr:1.11::el9 |
|
| Red Hat | OpenShift API for Data Protection 1.4 |
cpe:/a:redhat:openshift_api_data_protection:1.4::el9 |
|
| Red Hat | OpenShift API for Data Protection 1.5 |
cpe:/a:redhat:openshift_api_data_protection:1.5::el9 |
|
| Red Hat | OpenShift Compliance Operator 1 |
cpe:/a:redhat:openshift_compliance_operator:1::el9 |
|
| Red Hat | OpenShift File Integrity Operator - FIO 1 |
cpe:/a:redhat:openshift_file_integrity_operator:1::el9 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 |
cpe:/a:redhat:acm:2.14::el9 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 |
cpe:/a:redhat:acm:2.15::el9 |
|
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 |
cpe:/a:redhat:advanced_cluster_security:4.10::el8 |
|
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.8 |
cpe:/a:redhat:advanced_cluster_security:4.8::el8 |
|
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.9 |
cpe:/a:redhat:advanced_cluster_security:4.9::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Developer Hub 1.8 |
cpe:/a:redhat:rhdh:1.8::el9 |
|
| Red Hat | Red Hat Developer Hub 1.9 |
cpe:/a:redhat:rhdh:1.9::el9 |
|
| Red Hat | Red Hat Enterprise Linux AI 3.3 |
cpe:/a:redhat:enterprise_linux_ai:3.3::el9 |
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Lightspeed (formerly Insights) for Runtimes 1 |
cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift Builds 1.6.5 |
cpe:/a:redhat:openshift_builds:1.6::el9 |
|
| Red Hat | Red Hat OpenShift Builds 1.7.3 |
cpe:/a:redhat:openshift_builds:1.7::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.15 |
cpe:/a:redhat:openshift:4.15::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.17 |
cpe:/a:redhat:openshift:4.17::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.19 |
cpe:/a:redhat:openshift:4.19::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.20 |
cpe:/a:redhat:openshift:4.20::el9 |
|
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 |
cpe:/a:redhat:openshift_devspaces:3.27::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 2.6 |
cpe:/a:redhat:service_mesh:2.6::el8 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.0 |
cpe:/a:redhat:service_mesh:3.0::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.1 |
cpe:/a:redhat:service_mesh:3.1::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.2 |
cpe:/a:redhat:service_mesh:3.2::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.3 |
cpe:/a:redhat:service_mesh:3.3::el9 |
|
| Red Hat | Red Hat OpenShift distributed tracing 3.9.3 |
cpe:/a:redhat:openshift_distributed_tracing:3.9::el9 |
|
| Red Hat | Red Hat OpenStack 1.5 |
cpe:/a:redhat:stf:1.5::el9 |
|
| Red Hat | Red Hat OpenStack Services on OpenShift 18 |
cpe:/a:redhat:openstack:18.0::el9 |
|
| Red Hat | Red Hat Quay 3.10 |
cpe:/a:redhat:quay:3.10::el8 |
|
| Red Hat | Red Hat Quay 3.12 |
cpe:/a:redhat:quay:3.12::el8 |
|
| Red Hat | Red Hat Quay 3.14 |
cpe:/a:redhat:quay:3.14::el8 |
|
| Red Hat | Red Hat Quay 3.15 |
cpe:/a:redhat:quay:3.15::el8 |
|
| Red Hat | Red Hat Quay 3.16 |
cpe:/a:redhat:quay:3.16::el9 |
|
| Red Hat | Red Hat Quay 3.9 |
cpe:/a:redhat:quay:3.9::el8 |
|
| Red Hat | Red Hat Satellite 6.18 |
cpe:/a:redhat:satellite:6.18::el9 |
|
| Red Hat | Red Hat Trusted Artifact Signer 1.3 |
cpe:/a:redhat:trusted_artifact_signer:1.3::el9 |
|
| Red Hat | Red Hat Update Infrastructure 5 |
cpe:/a:redhat:rhui:5::el9 |
|
| Red Hat | Red Hat Web Terminal 1.11 |
cpe:/a:redhat:webterminal:1.11::el9 |
|
| Red Hat | Red Hat Web Terminal 1.12 |
cpe:/a:redhat:webterminal:1.12::el9 |
|
| Red Hat | Red Hat Web Terminal 1.13 |
cpe:/a:redhat:webterminal:1.13::el9 |
|
| Red Hat | Red Hat Web Terminal 1.14 |
cpe:/a:redhat:webterminal:1.14::el9 |
|
| Red Hat | Red Hat Web Terminal 1.15 |
cpe:/a:redhat:webterminal:1.15::el9 |
|
| Red Hat | mirror registry for Red Hat OpenShift 2.0 |
cpe:/a:redhat:mirror_registry:2.0::el8 |
|
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 |
cpe:/a:redhat:assisted_installer:2 |
|
| Red Hat | cert-manager Operator for Red Hat OpenShift |
cpe:/a:redhat:cert_manager:1 |
|
| Red Hat | Confidential Compute Attestation |
cpe:/a:redhat:confidential_compute_attestation:1 |
|
| Red Hat | Deployment Validation Operator |
cpe:/a:redhat:deployment_validator_operator |
|
| Red Hat | External Secrets Operator for Red Hat OpenShift |
cpe:/a:redhat:external_secrets_operator:1 |
|
| Red Hat | ExternalDNS Operator |
cpe:/a:redhat:ext_dns_optr:1 |
|
| Red Hat | Fence Agents Remediation Operator |
cpe:/a:redhat:workload_availability_far:0 |
|
| Red Hat | Gatekeeper 3 |
cpe:/a:redhat:gatekeeper:3 |
|
| Red Hat | Logging Subsystem for Red Hat OpenShift |
cpe:/a:redhat:logging:5 |
|
| Red Hat | Logical Volume Manager Storage |
cpe:/a:redhat:lvms:4 |
|
| Red Hat | Machine Deletion Remediation Operator |
cpe:/a:redhat:workload_availability_mdr:0 |
|
| Red Hat | Migration Toolkit for Containers |
cpe:/a:redhat:rhmt:1 |
|
| Red Hat | mirror registry for Red Hat OpenShift |
cpe:/a:redhat:mirror_registry:1 |
|
| Red Hat | Multicluster Engine for Kubernetes |
cpe:/a:redhat:multicluster_engine |
|
| Red Hat | OpenShift Developer Tools and Services |
cpe:/a:redhat:ocp_tools |
|
| Red Hat | OpenShift Lightspeed |
cpe:/a:redhat:openshift_lightspeed |
|
| Red Hat | OpenShift Pipelines |
cpe:/a:redhat:openshift_pipelines:1 |
|
| Red Hat | OpenShift Serverless |
cpe:/a:redhat:serverless:1 |
|
| Red Hat | OpenShift Service Mesh 2 |
cpe:/a:redhat:service_mesh:2 |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
|
| Red Hat | Red Hat Certification Program for Red Hat Enterprise Linux 9 |
cpe:/a:redhat:certifications:9 |
|
| Red Hat | Red Hat Connectivity Link 1 |
cpe:/a:redhat:connectivity_link:1 |
|
| Red Hat | Red Hat Edge Manager 1 |
cpe:/a:redhat:edge_manager:1 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat OpenShift Cluster Manager CLI |
cpe:/a:redhat:openshift_cluster_manager_cli:1 |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4 |
|
| Red Hat | Red Hat Openshift Data Foundation 4 |
cpe:/a:redhat:openshift_data_foundation:4 |
|
| Red Hat | Red Hat OpenShift GitOps |
cpe:/a:redhat:openshift_gitops:1 |
|
| Red Hat | Red Hat OpenShift on AWS |
cpe:/a:redhat:openshift_service_on_aws:1 |
|
| Red Hat | Red Hat OpenShift Virtualization 4 |
cpe:/a:redhat:container_native_virtualization:4 |
|
| Red Hat | Red Hat OpenStack Platform 16.2 |
cpe:/a:redhat:openstack:16.2 |
|
| Red Hat | Red Hat OpenStack Platform 18.0 |
cpe:/a:redhat:openstack:18.0 |
|
| Red Hat | Red Hat Quay 3 |
cpe:/a:redhat:quay:3 |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
|
| Red Hat | Red Hat Service Interconnect 1 |
cpe:/a:redhat:service_interconnect:1 |
|
| Red Hat | Red Hat Service Interconnect 2 |
cpe:/a:redhat:service_interconnect:2 |
|
| Red Hat | Security Profiles Operator |
cpe:/a:redhat:openshift_security_profiles_operator:1 |
|
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3 |
|
| Red Hat | Zero Trust Workload Identity Manager |
cpe:/a:redhat:zero_trust_workload_identity_manager:1 |
|
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview |
cpe:/a:redhat:zero_trust_workload_identity_manager:0 |
|
| Red Hat | Migration Toolkit for Applications 8 |
cpe:/a:redhat:migration_toolkit_applications:8 |
|
| Red Hat | Node HealthCheck Operator |
cpe:/a:redhat:workload_availability_nhc:0 |
|
| Red Hat | Power monitoring for Red Hat OpenShift |
cpe:/a:redhat:openshift_power_monitoring |
|
| Red Hat | Red Hat AMQ Clients |
cpe:/a:redhat:amq_clients:2023 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2 |
|
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 |
cpe:/a:redhat:apache_camel_hawtio:4 |
|
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai |
|
| Red Hat | Red Hat OpenShift for Windows Containers |
cpe:/a:redhat:windows_machine_config |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-25679",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T13:36:26.554241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-10T13:37:02.459Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el10",
"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10"
],
"defaultStatus": "affected",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux Server (v. 7 ELS)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.12::el8",
"cpe:/a:redhat:openshift:4.12::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.12",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.13::el8",
"cpe:/a:redhat:openshift:4.13::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.13",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.14::el8",
"cpe:/a:redhat:openshift:4.14::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.14",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.16::el8",
"cpe:/a:redhat:openshift:4.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.16",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.18::el8",
"cpe:/a:redhat:openshift:4.18::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.18",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6.16::el8",
"cpe:/a:redhat:satellite_capsule:6.16::el8",
"cpe:/a:redhat:satellite_maintenance:6.16::el8",
"cpe:/a:redhat:satellite_utils:6.16::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6.16 for RHEL 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openstack:17.1",
"cpe:/a:redhat:openstack:17.1::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6.16::el9",
"cpe:/a:redhat:satellite_capsule:6.16::el9",
"cpe:/a:redhat:satellite_maintenance:6.16::el9",
"cpe:/a:redhat:satellite_utils:6.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6.16 for RHEL 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6.19::el9",
"cpe:/a:redhat:satellite_capsule:6.19::el9",
"cpe:/a:redhat:satellite_maintenance:6.19::el9",
"cpe:/a:redhat:satellite_utils:6.19::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6.19 for RHEL 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1",
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 10)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.2::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 9)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1",
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::crb"
],
"defaultStatus": "affected",
"product": "Red Hat CodeReady Linux Builder EUS (v.9.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::crb"
],
"defaultStatus": "affected",
"product": "Red Hat CodeReady Linux Builder EUS (v.9.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9"
],
"defaultStatus": "affected",
"product": "Custom Metric Autoscaler 2.19",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:devworkspace:0.40::el9"
],
"defaultStatus": "affected",
"product": "DevWorkspace Operator 0.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:logging:6.0::el9"
],
"defaultStatus": "affected",
"product": "Logging Subsystem for Red Hat OpenShift 6.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:logging:6.2::el9"
],
"defaultStatus": "affected",
"product": "Logging Subsystem for Red Hat OpenShift 6.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:logging:6.4::el9"
],
"defaultStatus": "affected",
"product": "Logging Subsystem for Red Hat OpenShift 6.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.3::el9"
],
"defaultStatus": "affected",
"product": "Multicluster Global Hub 1.3.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.4::el9"
],
"defaultStatus": "affected",
"product": "Multicluster Global Hub 1.4.5",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.5::el9"
],
"defaultStatus": "affected",
"product": "Multicluster Global Hub 1.5.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.6::el9"
],
"defaultStatus": "affected",
"product": "Multicluster Global Hub 1.6.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:network_observ_optr:1.11::el9"
],
"defaultStatus": "affected",
"product": "Network Observability (NETOBSERV) 1.11.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1.4::el9"
],
"defaultStatus": "affected",
"product": "OpenShift API for Data Protection 1.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1.5::el9"
],
"defaultStatus": "affected",
"product": "OpenShift API for Data Protection 1.5",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_compliance_operator:1::el9"
],
"defaultStatus": "affected",
"product": "OpenShift Compliance Operator 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_file_integrity_operator:1::el9"
],
"defaultStatus": "affected",
"product": "OpenShift File Integrity Operator - FIO 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2.14::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2.15::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.10::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.8::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.9::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhdh:1.8::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Developer Hub 1.8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhdh:1.9::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Developer Hub 1.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AI 3.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Lightspeed (formerly Insights) for Runtimes 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_builds:1.6::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Builds 1.6.5",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_builds:1.7::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Builds 1.7.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.17",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:2.6::el8"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 2.6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.0::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.1::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.2::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.3::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift distributed tracing 3.9.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:stf:1.5::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenStack 1.5",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openstack:18.0::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenStack Services on OpenShift 18",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.14::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.14",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6.18",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Trusted Artifact Signer 1.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:webterminal:1.11::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Web Terminal 1.11",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:webterminal:1.12::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Web Terminal 1.12",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:webterminal:1.13::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Web Terminal 1.13",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:webterminal:1.14::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Web Terminal 1.14",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:webterminal:1.15::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Web Terminal 1.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:mirror_registry:2.0::el8"
],
"defaultStatus": "affected",
"product": "mirror registry for Red Hat OpenShift 2.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:assisted_installer:2"
],
"defaultStatus": "affected",
"product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:cert_manager:1"
],
"defaultStatus": "affected",
"product": "cert-manager Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:confidential_compute_attestation:1"
],
"defaultStatus": "affected",
"product": "Confidential Compute Attestation",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:deployment_validator_operator"
],
"defaultStatus": "affected",
"product": "Deployment Validation Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:external_secrets_operator:1"
],
"defaultStatus": "affected",
"product": "External Secrets Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ext_dns_optr:1"
],
"defaultStatus": "affected",
"product": "ExternalDNS Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:workload_availability_far:0"
],
"defaultStatus": "affected",
"product": "Fence Agents Remediation Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:gatekeeper:3"
],
"defaultStatus": "affected",
"product": "Gatekeeper 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:lvms:4"
],
"defaultStatus": "affected",
"product": "Logical Volume Manager Storage",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:workload_availability_mdr:0"
],
"defaultStatus": "affected",
"product": "Machine Deletion Remediation Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhmt:1"
],
"defaultStatus": "affected",
"product": "Migration Toolkit for Containers",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:mirror_registry:1"
],
"defaultStatus": "affected",
"product": "mirror registry for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "affected",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
],
"defaultStatus": "affected",
"product": "OpenShift Pipelines",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:2"
],
"defaultStatus": "affected",
"product": "OpenShift Service Mesh 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:certifications:9"
],
"defaultStatus": "affected",
"product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:connectivity_link:1"
],
"defaultStatus": "affected",
"product": "Red Hat Connectivity Link 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:edge_manager:1"
],
"defaultStatus": "affected",
"product": "Red Hat Edge Manager 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_cluster_manager_cli:1"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Cluster Manager CLI",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_gitops:1"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift GitOps",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_service_on_aws:1"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift on AWS",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openstack:16.2"
],
"defaultStatus": "affected",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_interconnect:1"
],
"defaultStatus": "affected",
"product": "Red Hat Service Interconnect 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_interconnect:2"
],
"defaultStatus": "affected",
"product": "Red Hat Service Interconnect 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_security_profiles_operator:1"
],
"defaultStatus": "affected",
"product": "Security Profiles Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:1"
],
"defaultStatus": "affected",
"product": "Zero Trust Workload Identity Manager",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:0"
],
"defaultStatus": "affected",
"product": "Zero Trust Workload Identity Manager - Tech Preview",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8"
],
"defaultStatus": "unaffected",
"product": "Migration Toolkit for Applications 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:workload_availability_nhc:0"
],
"defaultStatus": "unaffected",
"product": "Node HealthCheck Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_power_monitoring"
],
"defaultStatus": "unaffected",
"product": "Power monitoring for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:amq_clients:2023"
],
"defaultStatus": "unaffected",
"product": "Red Hat AMQ Clients",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:apache_camel_hawtio:4"
],
"defaultStatus": "unaffected",
"product": "Red Hat build of Apache Camel - HawtIO 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:windows_machine_config"
],
"defaultStatus": "unaffected",
"product": "Red Hat OpenShift for Windows Containers",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-06T21:28:14.211Z",
"descriptions": [
{
"lang": "en",
"value": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1286",
"description": "Improper Validation of Syntactic Correctness of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T12:04:52.558Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"name": "RHBZ#2445356",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13508"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8855"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13512"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26527"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26541"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28886"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25043"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21655"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25180"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27076"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6341"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28047"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34365"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14868"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8314"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9435"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8856"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:5943"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10133"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8849"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8931"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17084"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19719"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19750"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17040"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7328"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10929"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16696"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11375"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10701"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8842"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7005"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8840"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:5941"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7992"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6344"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6388"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13642"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13643"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7669"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10169"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11413"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19032"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29195"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19133"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19022"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19027"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19026"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19049"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19135"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19017"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24386"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19055"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19132"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19031"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29035"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19126"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19128"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33722"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6949"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16875"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7011"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7009"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8456"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7674"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7878"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8853"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7879"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20581"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9043"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9094"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8434"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19634"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7876"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20582"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8860"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9093"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8851"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7877"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20584"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8877"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8878"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9695"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16102"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9436"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7883"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8881"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8949"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8852"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25252"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25251"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9434"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7833"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8879"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9090"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25248"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8322"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25253"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25250"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22733"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12030"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12032"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10712"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7834"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8930"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8882"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12033"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19721"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12028"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8324"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12031"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12029"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11749"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9109"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9439"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8848"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:5944"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8847"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8845"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9108"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19720"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19475"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17287"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7665"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9097"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9098"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7259"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8841"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:5942"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6382"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6383"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13671"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9044"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7315"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29455"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29703"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19350"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19181"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19185"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19184"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19353"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26445"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19207"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29702"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26636"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9872"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11800"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22347"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:5110"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21769"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16874"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29854"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8433"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22627"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25127"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8151"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13829"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20889"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11217"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13791"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9742"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6802"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10140"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10141"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7385"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7291"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9052"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10184"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:5549"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10158"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12282"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21696"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14100"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21691"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:15091"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28893"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14774"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20088"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17598"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21657"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20041"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6564"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11688"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11686"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9440"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9448"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9453"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9461"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14020"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11747"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11916"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11856"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21017"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11996"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14879"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10125"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10065"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11768"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10250"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10225"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8338"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8337"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8167"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28441"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:13508: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:8855: Red Hat Enterprise Linux Server (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:13512: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:26527: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:26541: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:28886: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:25043: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:21655: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:25180: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:27076: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:6341: Cryostat 4 on RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:28047: Red Hat OpenStack Platform 17.1"
},
{
"lang": "en",
"value": "RHSA-2026:34365: Red Hat Satellite 6.19 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:14868: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:8314: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:9435: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:8856: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:5943: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:10133: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:8849: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:8931: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:17084: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:19719: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:19750: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:17040: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:7328: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:10929: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:16696: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:11375: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:10701: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:8842: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:7005: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:8840: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:5941: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:7992: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:6344: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:6388: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:13642: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:13643: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:7669: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:10169: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:11413: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:11412: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19032: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:29195: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19133: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19022: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19027: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19026: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:22937: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19049: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19135: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:22450: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19017: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:24386: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19055: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19132: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19031: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:29035: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19126: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19128: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33722: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:6949: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:16875: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:7011: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:7009: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:8456: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:7674: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:7878: Red Hat Enterprise Linux AppStream AUS (v. 8.2)"
},
{
"lang": "en",
"value": "RHSA-2026:8853: Red Hat Enterprise Linux AppStream AUS (v. 8.2)"
},
{
"lang": "en",
"value": "RHSA-2026:7879: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:20581: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:9043: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:9094: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:8434: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:19634: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:7876: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:20582: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:8860: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:9093: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:8851: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:7877: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:20584: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:8877: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:8878: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:9695: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:16102: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:9436: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:7883: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:8881: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:8949: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:8852: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:25252: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:25251: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:9434: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:7833: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:8879: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:9090: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:25248: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:8322: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:25253: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:25250: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:22733: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:12030: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:12032: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:10712: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:7834: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:8930: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:8882: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:12033: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:19721: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:12028: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:8324: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:12031: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:12029: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:11749: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:9109: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:9439: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:8848: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:5944: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:8847: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:8845: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:9108: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:19720: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:19475: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:17287: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:7665: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:9097: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:9098: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:7259: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:8841: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:5942: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:6382: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:6383: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:13671: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:9044: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:7315: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:29455: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:29703: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19350: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19181: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19185: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19184: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:23228: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19353: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:22714: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:26445: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19207: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:29702: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:26636: Custom Metric Autoscaler 2.19"
},
{
"lang": "en",
"value": "RHSA-2026:9872: DevWorkspace Operator 0.4"
},
{
"lang": "en",
"value": "RHSA-2026:26585: Logging Subsystem for Red Hat OpenShift 6.0"
},
{
"lang": "en",
"value": "RHSA-2026:11800: Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"lang": "en",
"value": "RHSA-2026:22862: Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"lang": "en",
"value": "RHSA-2026:22423: Multicluster Global Hub 1.3.4"
},
{
"lang": "en",
"value": "RHSA-2026:22347: Multicluster Global Hub 1.4.5"
},
{
"lang": "en",
"value": "RHSA-2026:5110: Multicluster Global Hub 1.5.4"
},
{
"lang": "en",
"value": "RHSA-2026:21769: Multicluster Global Hub 1.5.4"
},
{
"lang": "en",
"value": "RHSA-2026:23345: Multicluster Global Hub 1.6.2"
},
{
"lang": "en",
"value": "RHSA-2026:16874: Network Observability (NETOBSERV) 1.11.2"
},
{
"lang": "en",
"value": "RHSA-2026:29854: OpenShift API for Data Protection 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:26568: OpenShift API for Data Protection 1.5"
},
{
"lang": "en",
"value": "RHSA-2026:8433: OpenShift Compliance Operator 1"
},
{
"lang": "en",
"value": "RHSA-2026:22627: OpenShift File Integrity Operator - FIO 1"
},
{
"lang": "en",
"value": "RHSA-2026:25127: Red Hat Advanced Cluster Management for Kubernetes 2.14"
},
{
"lang": "en",
"value": "RHSA-2026:8151: Red Hat Advanced Cluster Management for Kubernetes 2.15"
},
{
"lang": "en",
"value": "RHSA-2026:13829: Red Hat Advanced Cluster Security for Kubernetes 4.10"
},
{
"lang": "en",
"value": "RHSA-2026:20889: Red Hat Advanced Cluster Security for Kubernetes 4.10"
},
{
"lang": "en",
"value": "RHSA-2026:11217: Red Hat Advanced Cluster Security for Kubernetes 4.8"
},
{
"lang": "en",
"value": "RHSA-2026:13791: Red Hat Advanced Cluster Security for Kubernetes 4.9"
},
{
"lang": "en",
"value": "RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:9742: Red Hat Developer Hub 1.8"
},
{
"lang": "en",
"value": "RHSA-2026:6802: Red Hat Developer Hub 1.9"
},
{
"lang": "en",
"value": "RHSA-2026:10140: Red Hat Enterprise Linux AI 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:10141: Red Hat Enterprise Linux AI 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:7385: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:7291: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:9052: Red Hat Lightspeed (formerly Insights) for Runtimes 1"
},
{
"lang": "en",
"value": "RHSA-2026:10184: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:5549: Red Hat OpenShift Builds 1.6.5"
},
{
"lang": "en",
"value": "RHSA-2026:10158: Red Hat OpenShift Builds 1.7.3"
},
{
"lang": "en",
"value": "RHSA-2026:12282: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:21696: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:14100: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:21691: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:15091: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:28893: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:14774: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:20088: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:17598: Red Hat OpenShift Container Platform 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:21657: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:20041: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:6564: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27"
},
{
"lang": "en",
"value": "RHSA-2026:11688: Red Hat OpenShift Service Mesh 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:8483: Red Hat OpenShift Service Mesh 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:11686: Red Hat OpenShift Service Mesh 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:9440: Red Hat OpenShift Service Mesh 3.0"
},
{
"lang": "en",
"value": "RHSA-2026:8484: Red Hat OpenShift Service Mesh 3.0"
},
{
"lang": "en",
"value": "RHSA-2026:9448: Red Hat OpenShift Service Mesh 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:8490: Red Hat OpenShift Service Mesh 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:9453: Red Hat OpenShift Service Mesh 3.2"
},
{
"lang": "en",
"value": "RHSA-2026:8491: Red Hat OpenShift Service Mesh 3.2"
},
{
"lang": "en",
"value": "RHSA-2026:9461: Red Hat OpenShift Service Mesh 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:8493: Red Hat OpenShift Service Mesh 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:9385: Red Hat OpenShift distributed tracing 3.9.3"
},
{
"lang": "en",
"value": "RHSA-2026:14020: Red Hat OpenStack 1.5"
},
{
"lang": "en",
"value": "RHSA-2026:11747: Red Hat OpenStack Services on OpenShift 18"
},
{
"lang": "en",
"value": "RHSA-2026:11916: Red Hat Quay 3.10"
},
{
"lang": "en",
"value": "RHSA-2026:6720: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:11856: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:21017: Red Hat Quay 3.14"
},
{
"lang": "en",
"value": "RHSA-2026:24853: Red Hat Quay 3.15"
},
{
"lang": "en",
"value": "RHSA-2026:19375: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:11996: Red Hat Quay 3.9"
},
{
"lang": "en",
"value": "RHSA-2026:14879: Red Hat Satellite 6.18"
},
{
"lang": "en",
"value": "RHSA-2026:10125: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:10065: Red Hat Update Infrastructure 5"
},
{
"lang": "en",
"value": "RHSA-2026:11768: Red Hat Update Infrastructure 5"
},
{
"lang": "en",
"value": "RHSA-2026:10250: Red Hat Web Terminal 1.11"
},
{
"lang": "en",
"value": "RHSA-2026:10225: Red Hat Web Terminal 1.12"
},
{
"lang": "en",
"value": "RHSA-2026:8338: Red Hat Web Terminal 1.13"
},
{
"lang": "en",
"value": "RHSA-2026:8337: Red Hat Web Terminal 1.14"
},
{
"lang": "en",
"value": "RHSA-2026:8167: Red Hat Web Terminal 1.15"
},
{
"lang": "en",
"value": "RHSA-2026:28441: mirror registry for Red Hat OpenShift 2.0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-06T22:02:11.567Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-06T21:28:14.211Z",
"value": "Made public."
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "net/url",
"product": "net/url",
"programRoutines": [
{
"name": "parseHost"
},
{
"name": "JoinPath"
},
{
"name": "Parse"
},
{
"name": "ParseRequestURI"
},
{
"name": "URL.Parse"
},
{
"name": "URL.UnmarshalBinary"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.25.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.1",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Masaki Hara (https://github.com/qnighy) of Wantedly"
}
],
"descriptions": [
{
"lang": "en",
"value": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T21:28:14.211Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/752180"
},
{
"url": "https://go.dev/issue/77578"
},
{
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"title": "Incorrect parsing of IPv6 host literals in net/url"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-25679",
"datePublished": "2026-03-06T21:28:14.211Z",
"dateReserved": "2026-02-05T01:33:41.943Z",
"dateUpdated": "2026-07-02T12:04:52.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-25679",
"date": "2026-07-02",
"epss": "0.00728",
"percentile": "0.49682"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-25679\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2026-03-06T22:16:00.720\",\"lastModified\":\"2026-07-02T12:16:57.677\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.\"},{\"lang\":\"es\",\"value\":\"url.Parse valid\u00f3 insuficientemente el componente de host/autoridad y acept\u00f3 algunas URL inv\u00e1lidas.\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"Go standard library\",\"product\":\"net/url\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"net/url\",\"programRoutines\":[{\"name\":\"parseHost\"},{\"name\":\"JoinPath\"},{\"name\":\"Parse\"},{\"name\":\"ParseRequestURI\"},{\"name\":\"URL.Parse\"},{\"name\":\"URL.UnmarshalBinary\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.25.8\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.26.0-0\",\"lessThan\":\"1.26.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6 for RHEL 10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el10\",\"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux Server (v. 7 ELS)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:rhel_els:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\",\"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8\",\"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.12\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.12::el8\",\"cpe:/a:redhat:openshift:4.12::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.13\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.13::el8\",\"cpe:/a:redhat:openshift:4.13::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.14\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.14::el8\",\"cpe:/a:redhat:openshift:4.14::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.16\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.16::el8\",\"cpe:/a:redhat:openshift:4.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.18\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.18::el8\",\"cpe:/a:redhat:openshift:4.18::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el8\",\"cpe:/a:redhat:satellite_capsule:6.16::el8\",\"cpe:/a:redhat:satellite_maintenance:6.16::el8\",\"cpe:/a:redhat:satellite_utils:6.16::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\",\"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9\",\"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6 for RHEL 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\",\"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9\",\"cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4 on RHEL 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:cryostat:4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\",\"cpe:/a:redhat:openstack:17.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el9\",\"cpe:/a:redhat:satellite_capsule:6.16::el9\",\"cpe:/a:redhat:satellite_maintenance:6.16::el9\",\"cpe:/a:redhat:satellite_utils:6.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.19 for RHEL 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6.19::el9\",\"cpe:/a:redhat:satellite_capsule:6.19::el9\",\"cpe:/a:redhat:satellite_maintenance:6.19::el9\",\"cpe:/a:redhat:satellite_utils:6.19::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS (v. 10.0)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 10)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.1\",\"cpe:/o:redhat:enterprise_linux:10.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream AUS (v. 8.2)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.2::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream AUS (v.8.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream AUS (v.8.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.8.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream TUS (v.8.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.8.8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream TUS (v.8.8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.9.0)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.0::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.9.2)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.9.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS (v.9.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS (v.9.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 9)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.1\",\"cpe:/o:redhat:enterprise_linux:10.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat CodeReady Linux Builder EUS (v.9.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.4::crb\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat CodeReady Linux Builder EUS (v.9.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6::crb\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::crb\"]},{\"vendor\":\"Red Hat\",\"product\":\"Custom Metric Autoscaler 2.19\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"DevWorkspace Operator 0.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:devworkspace:0.40::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift 6.0\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:logging:6.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift 6.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:logging:6.2::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift 6.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:logging:6.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.3.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.4.5\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.5.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.6.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.6::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability (NETOBSERV) 1.11.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1.11::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection 1.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection 1.5\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1.5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Compliance Operator 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_compliance_operator:1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift File Integrity Operator - FIO 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_file_integrity_operator:1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.14\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2.14::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2.15::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.8::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub 1.8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhdh:1.8::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub 1.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhdh:1.9::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Lightspeed (formerly Insights) for Runtimes 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Builds 1.6.5\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_builds:1.6::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Builds 1.7.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_builds:1.7::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.15::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.17\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.17::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.20\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.20::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.27\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 2.6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2.6::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.0\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.2::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift distributed tracing 3.9.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_distributed_tracing:3.9::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack 1.5\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:stf:1.5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Services on OpenShift 18\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.10::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.12\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.12::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.14\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.14::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.15::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.9::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.11\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.11::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.12\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.12::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.13\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.13::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.14\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.14::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.15::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"mirror registry for Red Hat OpenShift 2.0\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:mirror_registry:2.0::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Assisted Installer for Red Hat OpenShift Container Platform 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:assisted_installer:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"cert-manager Operator for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:cert_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Confidential Compute Attestation\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:confidential_compute_attestation:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Deployment Validation Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:deployment_validator_operator\"]},{\"vendor\":\"Red Hat\",\"product\":\"External Secrets Operator for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:external_secrets_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"ExternalDNS Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ext_dns_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Fence Agents Remediation Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:workload_availability_far:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Gatekeeper 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:gatekeeper:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logical Volume Manager Storage\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:lvms:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Machine Deletion Remediation Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:workload_availability_mdr:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Containers\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhmt:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"mirror registry for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:mirror_registry:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Pipelines\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Certification Program for Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:certifications:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Connectivity Link 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:connectivity_link:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Edge Manager 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Cluster Manager CLI\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_cluster_manager_cli:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift on AWS\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_service_on_aws:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openstack:16.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Service Interconnect 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_interconnect:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Service Interconnect 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_interconnect:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Security Profiles Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_security_profiles_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager - Tech Preview\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Applications 8\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_applications:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Node HealthCheck Operator\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:workload_availability_nhc:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Power monitoring for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:openshift_power_monitoring\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel - HawtIO 4\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:apache_camel_hawtio:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift for Windows Containers\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:windows_machine_config\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-10T13:36:26.554241Z\",\"id\":\"CVE-2026-25679\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-425\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1286\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.25.8\",\"matchCriteriaId\":\"2D293CC0-B163-4E62-B985-52FB6ECA64C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:1.26.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A40FE3CB-0D03-462B-8A19-4DF1920ABE82\"}]}]}],\"references\":[{\"url\":\"https://go.dev/cl/752180\",\"source\":\"security@golang.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://go.dev/issue/77578\",\"source\":\"security@golang.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk\",\"source\":\"security@golang.org\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://pkg.go.dev/vuln/GO-2026-4601\",\"source\":\"security@golang.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10065\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10125\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10133\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10140\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10141\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10158\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10169\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10175\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10184\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10225\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10250\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10701\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10712\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10929\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11217\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11375\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11412\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11413\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11686\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11688\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11747\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11749\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11768\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11800\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11856\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11916\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11996\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12028\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12029\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12030\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12031\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12032\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12033\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12282\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13508\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13512\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13545\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13642\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13643\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13671\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13791\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13829\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14020\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14100\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14774\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14868\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14879\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:15091\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:16102\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:16696\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:16874\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:16875\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17040\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17084\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17287\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17598\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19017\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19022\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19026\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19027\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19031\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19032\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19049\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19055\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19126\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19128\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19132\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19133\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19135\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19181\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19184\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19185\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19207\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19350\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19353\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19375\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19475\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19634\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19719\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19720\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19721\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19750\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20041\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20088\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20581\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20582\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20584\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20889\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21017\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21655\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21657\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21691\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21696\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21769\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22347\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22423\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22450\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22627\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22714\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22733\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22862\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22937\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23228\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23345\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24386\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24853\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25043\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25127\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25180\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25248\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25250\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25251\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25252\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25253\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26445\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26527\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26541\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26568\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26585\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26636\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27076\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28047\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28441\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28886\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28893\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29035\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29195\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29455\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29702\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29703\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29854\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33722\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34365\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5110\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5549\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5941\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5942\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5943\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5944\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6341\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6344\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6382\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6383\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6388\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6564\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6720\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6802\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6949\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7005\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7009\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7011\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7259\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7291\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7315\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7328\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7385\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7665\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7669\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7674\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7833\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7834\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7876\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7877\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7878\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7879\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7883\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7992\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8151\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8167\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8314\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8322\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8324\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8337\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8338\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8433\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8434\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8456\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8483\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8484\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8490\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8491\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8493\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8840\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8841\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8842\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8845\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8847\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8848\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8849\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8851\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8852\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8853\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8855\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8856\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8860\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8877\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8878\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8879\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8881\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8882\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8930\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8931\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8949\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9043\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9044\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9052\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9090\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9093\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9094\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9097\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9098\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9108\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9109\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9385\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9434\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9435\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9436\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9439\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9440\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9448\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9453\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9461\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9695\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9742\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9872\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-25679\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2445356\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"net/url: Incorrect parsing of IPv6 host literals in net/url\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el10\", \"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6 for RHEL 10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_els:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux Server (v. 7 ELS)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\", \"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8\", \"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.12::el8\", \"cpe:/a:redhat:openshift:4.12::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.12\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.13::el8\", \"cpe:/a:redhat:openshift:4.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.13\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.14::el8\", \"cpe:/a:redhat:openshift:4.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.14\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.16::el8\", \"cpe:/a:redhat:openshift:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.18::el8\", \"cpe:/a:redhat:openshift:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.18\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el8\", \"cpe:/a:redhat:satellite_capsule:6.16::el8\", \"cpe:/a:redhat:satellite_maintenance:6.16::el8\", \"cpe:/a:redhat:satellite_utils:6.16::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\", \"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9\", \"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\", \"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9\", \"cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6 for RHEL 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4 on RHEL 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\", \"cpe:/a:redhat:openstack:17.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el9\", \"cpe:/a:redhat:satellite_capsule:6.16::el9\", \"cpe:/a:redhat:satellite_maintenance:6.16::el9\", \"cpe:/a:redhat:satellite_utils:6.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.19::el9\", \"cpe:/a:redhat:satellite_capsule:6.19::el9\", \"cpe:/a:redhat:satellite_maintenance:6.19::el9\", \"cpe:/a:redhat:satellite_utils:6.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.19 for RHEL 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS (v. 10.0)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.1\", \"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 10)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.2::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream AUS (v. 8.2)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream AUS (v.8.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream AUS (v.8.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.8.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_tus:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream TUS (v.8.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.8.8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_tus:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream TUS (v.8.8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.0::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.9.0)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.2::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.9.2)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.9.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS (v.9.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS (v.9.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 9)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.1\", \"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.4::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat CodeReady Linux Builder EUS (v.9.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat CodeReady Linux Builder EUS (v.9.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Custom Metric Autoscaler 2.19\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:devworkspace:0.40::el9\"], \"vendor\": \"Red Hat\", \"product\": \"DevWorkspace Operator 0.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift 6.0\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift 6.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift 6.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.3.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.4.5\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.5.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.6.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability (NETOBSERV) 1.11.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection 1.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection 1.5\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_compliance_operator:1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Compliance Operator 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_file_integrity_operator:1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift File Integrity Operator - FIO 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.14\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.8::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub 1.8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub 1.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Lightspeed (formerly Insights) for Runtimes 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_builds:1.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Builds 1.6.5\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_builds:1.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Builds 1.7.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.17\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.19\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.20\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.27\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2.6::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 2.6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.0\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_distributed_tracing:3.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift distributed tracing 3.9.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:stf:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack 1.5\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Services on OpenShift 18\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.12\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.14::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.14\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.11\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.12::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.12\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.13\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.14\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:mirror_registry:2.0::el8\"], \"vendor\": \"Red Hat\", \"product\": \"mirror registry for Red Hat OpenShift 2.0\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:assisted_installer:2\"], \"vendor\": \"Red Hat\", \"product\": \"Assisted Installer for Red Hat OpenShift Container Platform 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cert_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"cert-manager Operator for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:confidential_compute_attestation:1\"], \"vendor\": \"Red Hat\", \"product\": \"Confidential Compute Attestation\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:deployment_validator_operator\"], \"vendor\": \"Red Hat\", \"product\": \"Deployment Validation Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:external_secrets_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"External Secrets Operator for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ext_dns_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"ExternalDNS Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_far:0\"], \"vendor\": \"Red Hat\", \"product\": \"Fence Agents Remediation Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:gatekeeper:3\"], \"vendor\": \"Red Hat\", \"product\": \"Gatekeeper 3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lvms:4\"], \"vendor\": \"Red Hat\", \"product\": \"Logical Volume Manager Storage\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_mdr:0\"], \"vendor\": \"Red Hat\", \"product\": \"Machine Deletion Remediation Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhmt:1\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Containers\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:mirror_registry:1\"], \"vendor\": \"Red Hat\", \"product\": \"mirror registry for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Pipelines\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:certifications:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Certification Program for Red Hat Enterprise Linux 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:connectivity_link:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Connectivity Link 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Edge Manager 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_cluster_manager_cli:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Cluster Manager CLI\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_service_on_aws:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift on AWS\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:16.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 16.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_interconnect:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Service Interconnect 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_interconnect:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Service Interconnect 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_security_profiles_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"Security Profiles Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_applications:8\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Applications 8\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_nhc:0\"], \"vendor\": \"Red Hat\", \"product\": \"Node HealthCheck Operator\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_power_monitoring\"], \"vendor\": \"Red Hat\", \"product\": \"Power monitoring for Red Hat OpenShift\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_clients:2023\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Clients\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_hawtio:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel - HawtIO 4\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:windows_machine_config\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift for Windows Containers\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-03-06T22:02:11.567Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-03-06T21:28:14.211Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:13508: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8855: Red Hat Enterprise Linux Server (v. 7 ELS)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13512: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26527: Red Hat OpenShift Container Platform 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26541: Red Hat OpenShift Container Platform 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28886: Red Hat OpenShift Container Platform 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25043: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21655: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25180: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27076: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6341: Cryostat 4 on RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28047: Red Hat OpenStack Platform 17.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34365: Red Hat Satellite 6.19 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14868: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8314: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9435: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8856: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:5943: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10133: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8849: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8931: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17084: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19719: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19750: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17040: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7328: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10929: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:16696: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11375: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10701: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8842: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7005: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8840: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:5941: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7992: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6344: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6388: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13642: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13643: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7669: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10169: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11413: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11412: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19032: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29195: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19133: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19022: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19027: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19026: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22937: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19049: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19135: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22450: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19017: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24386: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19055: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19132: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19031: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29035: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19126: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19128: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33722: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6949: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:16875: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7011: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7009: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8456: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7674: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7878: Red Hat Enterprise Linux AppStream AUS (v. 8.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8853: Red Hat Enterprise Linux AppStream AUS (v. 8.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7879: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20581: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9043: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9094: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8434: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19634: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7876: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20582: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8860: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9093: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8851: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7877: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20584: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8877: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8878: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9695: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:16102: Red Hat Enterprise Linux AppStream E4S (v.9.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9436: Red Hat Enterprise Linux AppStream E4S (v.9.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7883: Red Hat Enterprise Linux AppStream E4S (v.9.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8881: Red Hat Enterprise Linux AppStream E4S (v.9.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8949: Red Hat Enterprise Linux AppStream E4S (v.9.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8852: Red Hat Enterprise Linux AppStream E4S (v.9.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25252: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25251: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9434: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7833: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8879: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9090: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25248: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8322: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25253: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25250: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22733: Red Hat Enterprise Linux AppStream E4S (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12030: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12032: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10712: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7834: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8930: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8882: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12033: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19721: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12028: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8324: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12031: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12029: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11749: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9109: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9439: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8848: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:5944: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8847: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8845: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9108: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19720: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19475: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17287: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7665: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9097: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9098: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7259: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8841: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:5942: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6382: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6383: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13671: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9044: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7315: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29455: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29703: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19350: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19181: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19185: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19184: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23228: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19353: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22714: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26445: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19207: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29702: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26636: Custom Metric Autoscaler 2.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9872: DevWorkspace Operator 0.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26585: Logging Subsystem for Red Hat OpenShift 6.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11800: Logging Subsystem for Red Hat OpenShift 6.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22862: Logging Subsystem for Red Hat OpenShift 6.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22423: Multicluster Global Hub 1.3.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22347: Multicluster Global Hub 1.4.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:5110: Multicluster Global Hub 1.5.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21769: Multicluster Global Hub 1.5.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23345: Multicluster Global Hub 1.6.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:16874: Network Observability (NETOBSERV) 1.11.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29854: OpenShift API for Data Protection 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26568: OpenShift API for Data Protection 1.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8433: OpenShift Compliance Operator 1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22627: OpenShift File Integrity Operator - FIO 1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25127: Red Hat Advanced Cluster Management for Kubernetes 2.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8151: Red Hat Advanced Cluster Management for Kubernetes 2.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13829: Red Hat Advanced Cluster Security for Kubernetes 4.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20889: Red Hat Advanced Cluster Security for Kubernetes 4.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11217: Red Hat Advanced Cluster Security for Kubernetes 4.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13791: Red Hat Advanced Cluster Security for Kubernetes 4.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9742: Red Hat Developer Hub 1.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6802: Red Hat Developer Hub 1.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10140: Red Hat Enterprise Linux AI 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10141: Red Hat Enterprise Linux AI 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7385: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7291: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9052: Red Hat Lightspeed (formerly Insights) for Runtimes 1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10184: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:5549: Red Hat OpenShift Builds 1.6.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10158: Red Hat OpenShift Builds 1.7.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12282: Red Hat OpenShift Container Platform 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21696: Red Hat OpenShift Container Platform 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14100: Red Hat OpenShift Container Platform 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21691: Red Hat OpenShift Container Platform 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:15091: Red Hat OpenShift Container Platform 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28893: Red Hat OpenShift Container Platform 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14774: Red Hat OpenShift Container Platform 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20088: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17598: Red Hat OpenShift Container Platform 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21657: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20041: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6564: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11688: Red Hat OpenShift Service Mesh 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8483: Red Hat OpenShift Service Mesh 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11686: Red Hat OpenShift Service Mesh 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9440: Red Hat OpenShift Service Mesh 3.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8484: Red Hat OpenShift Service Mesh 3.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9448: Red Hat OpenShift Service Mesh 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8490: Red Hat OpenShift Service Mesh 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9453: Red Hat OpenShift Service Mesh 3.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8491: Red Hat OpenShift Service Mesh 3.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9461: Red Hat OpenShift Service Mesh 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8493: Red Hat OpenShift Service Mesh 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9385: Red Hat OpenShift distributed tracing 3.9.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14020: Red Hat OpenStack 1.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11747: Red Hat OpenStack Services on OpenShift 18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11916: Red Hat Quay 3.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6720: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11856: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21017: Red Hat Quay 3.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24853: Red Hat Quay 3.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19375: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11996: Red Hat Quay 3.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14879: Red Hat Satellite 6.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10125: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10065: Red Hat Update Infrastructure 5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11768: Red Hat Update Infrastructure 5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10250: Red Hat Web Terminal 1.11\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10225: Red Hat Web Terminal 1.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8338: Red Hat Web Terminal 1.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8337: Red Hat Web Terminal 1.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8167: Red Hat Web Terminal 1.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28441: mirror registry for Red Hat OpenShift 2.0\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-03-06T21:28:14.211Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-25679\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2445356\", \"name\": \"RHBZ#2445356\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13508\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8855\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13512\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26527\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26541\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28886\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25043\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21655\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25180\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27076\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6341\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28047\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34365\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14868\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8314\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9435\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8856\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5943\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10133\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8849\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8931\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17084\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19719\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19750\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17040\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7328\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10929\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:16696\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11375\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10701\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8842\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7005\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8840\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5941\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7992\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6344\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6388\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13642\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13643\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7669\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10169\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11413\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11412\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19032\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29195\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19133\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19022\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19027\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19026\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22937\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19049\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19135\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22450\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19017\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24386\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19055\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19132\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19031\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29035\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19126\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19128\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33722\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6949\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:16875\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7011\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7009\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8456\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7674\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7878\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8853\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7879\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20581\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9043\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9094\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8434\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19634\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7876\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20582\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8860\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9093\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8851\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7877\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20584\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8877\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8878\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9695\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:16102\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9436\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7883\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8881\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8949\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8852\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25252\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25251\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9434\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7833\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8879\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9090\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25248\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8322\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25253\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25250\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22733\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12030\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12032\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10712\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7834\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8930\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8882\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12033\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19721\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12028\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8324\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12031\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12029\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11749\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9109\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9439\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8848\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5944\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8847\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8845\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9108\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19720\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19475\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17287\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7665\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9097\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9098\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7259\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8841\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5942\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6382\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6383\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13671\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9044\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7315\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29455\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29703\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19350\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19181\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19185\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19184\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23228\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19353\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22714\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26445\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19207\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29702\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26636\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9872\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26585\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11800\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22862\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22423\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22347\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5110\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21769\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23345\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:16874\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29854\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26568\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8433\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22627\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25127\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8151\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13829\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20889\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11217\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13791\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13545\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9742\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6802\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10140\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10141\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7385\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7291\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9052\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10184\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5549\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10158\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12282\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21696\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14100\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21691\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:15091\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28893\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14774\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20088\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17598\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21657\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20041\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6564\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10175\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11688\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8483\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11686\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9440\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8484\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9448\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8490\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9453\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8491\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9461\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8493\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9385\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14020\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11747\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11916\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6720\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11856\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21017\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24853\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19375\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11996\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14879\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10125\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10065\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11768\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10250\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10225\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8338\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8337\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8167\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28441\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1286\", \"description\": \"Improper Validation of Syntactic Correctness of Input\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-02T12:04:52.558Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-25679\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-10T13:36:26.554241Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-10T13:36:57.330Z\"}}], \"cna\": {\"title\": \"Incorrect parsing of IPv6 host literals in net/url\", \"credits\": [{\"lang\": \"en\", \"value\": \"Masaki Hara (https://github.com/qnighy) of Wantedly\"}], \"affected\": [{\"vendor\": \"Go standard library\", \"product\": \"net/url\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.25.8\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.26.0-0\", \"lessThan\": \"1.26.1\", \"versionType\": \"semver\"}], \"packageName\": \"net/url\", \"collectionURL\": \"https://pkg.go.dev\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"parseHost\"}, {\"name\": \"JoinPath\"}, {\"name\": \"Parse\"}, {\"name\": \"ParseRequestURI\"}, {\"name\": \"URL.Parse\"}, {\"name\": \"URL.UnmarshalBinary\"}]}], \"references\": [{\"url\": \"https://go.dev/cl/752180\"}, {\"url\": \"https://go.dev/issue/77578\"}, {\"url\": \"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2026-4601\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-1286: Improper Validation of Syntactic Correctness of Input\"}]}], \"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2026-03-06T21:28:14.211Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-25679\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-02T12:04:52.558Z\", \"dateReserved\": \"2026-02-05T01:33:41.943Z\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"datePublished\": \"2026-03-06T21:28:14.211Z\", \"assignerShortName\": \"Go\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:22627
Vulnerability from csaf_redhat - Published: 2026-06-02 18:12 - Updated: 2026-07-02 19:38A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64 | — |
Workaround
|
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64 | — |
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64 | — |
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated OpenShift File Integrity Operator image that fixes various bugs and adds new\nenhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.",
"title": "Topic"
},
{
"category": "general",
"text": "The OpenShift File Integrity Operator v1.4.0 is now available.\nSee the documentation for bug fix information:\n\nhttps://docs.openshift.com/container-platform/latest/security/file_integrity_operator/file-integrity-operator-release-notes.html",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22627",
"url": "https://access.redhat.com/errata/RHSA-2026:22627"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22627.json"
}
],
"title": "Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-07-02T19:38:52+00:00",
"generator": {
"date": "2026-07-02T19:38:52+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:22627",
"initial_release_date": "2026-06-02T18:12:25+00:00",
"revision_history": [
{
"date": "2026-06-02T18:12:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-02T18:12:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:38:52+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift File Integrity Operator - FIO 1",
"product": {
"name": "OpenShift File Integrity Operator - FIO 1",
"product_id": "OpenShift File Integrity Operator - FIO 1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_file_integrity_operator:1::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift File Integrity Operator - FIO"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64",
"product_id": "registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-file-integrity-operator-bundle@sha256%3A813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891?arch=amd64\u0026repository_url=registry.redhat.io/compliance/openshift-file-integrity-operator-bundle\u0026tag=1780397972"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"product_id": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-file-integrity-rhel8-operator@sha256%3A310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594?arch=amd64\u0026repository_url=registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator\u0026tag=1780389566"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"product": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"product_id": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openshift-file-integrity-rhel8-operator@sha256%3A04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator\u0026tag=1780389566"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x",
"product": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x",
"product_id": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openshift-file-integrity-rhel8-operator@sha256%3A5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124?arch=s390x\u0026repository_url=registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator\u0026tag=1780389566"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64 as a component of OpenShift File Integrity Operator - FIO 1",
"product_id": "OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64",
"relates_to_product_reference": "OpenShift File Integrity Operator - FIO 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le as a component of OpenShift File Integrity Operator - FIO 1",
"product_id": "OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le"
},
"product_reference": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"relates_to_product_reference": "OpenShift File Integrity Operator - FIO 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64 as a component of OpenShift File Integrity Operator - FIO 1",
"product_id": "OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"relates_to_product_reference": "OpenShift File Integrity Operator - FIO 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x as a component of OpenShift File Integrity Operator - FIO 1",
"product_id": "OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
},
"product_reference": "registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x",
"relates_to_product_reference": "OpenShift File Integrity Operator - FIO 1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
],
"known_not_affected": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T18:12:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22627"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
],
"known_not_affected": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T18:12:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22627"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
],
"known_not_affected": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T18:12:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22627"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:813c9713c4e2e5a1c26b3c1d0b9fbdff9b0eb7cc966e4aa54620822890965891_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:04da784838d3992a8db2d095ea1404cdb96bc07e0dd31878f3c1a4f6516ce2a7_ppc64le",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:310fd968ce23f308f35667fefa8028bfe41f947b90152b7244694785a7fc3594_amd64",
"OpenShift File Integrity Operator - FIO 1:registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:5b10e21ffe129532c9e31f6eb6554f77ac71e6de51679f35b1658040e0692124_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
}
]
}
RHSA-2026:22714
Vulnerability from csaf_redhat - Published: 2026-06-03 08:19 - Updated: 2026-07-02 22:08A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
No description is available for this CVE.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22714",
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2434431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"category": "external",
"summary": "2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "RHEL-179251",
"url": "https://issues.redhat.com/browse/RHEL-179251"
},
{
"category": "external",
"summary": "RHEL-180018",
"url": "https://issues.redhat.com/browse/RHEL-180018"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22714.json"
}
],
"title": "Red Hat Security Advisory: osbuild-composer security update",
"tracking": {
"current_release_date": "2026-07-02T22:08:02+00:00",
"generator": {
"date": "2026-07-02T22:08:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:22714",
"initial_release_date": "2026-06-03T08:19:01+00:00",
"revision_history": [
{
"date": "2026-06-03T08:19:01+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-03T08:19:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T22:08:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el9_8.src",
"product": {
"name": "osbuild-composer-0:165.1-2.el9_8.src",
"product_id": "osbuild-composer-0:165.1-2.el9_8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el9_8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el9_8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el9_8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-core-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el9_8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el9_8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src"
},
"product_reference": "osbuild-composer-0:165.1-2.el9_8.src",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-61728",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:39.965024+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434431"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "RHBZ#2434431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://go.dev/cl/736713",
"url": "https://go.dev/cl/736713"
},
{
"category": "external",
"summary": "https://go.dev/issue/77102",
"url": "https://go.dev/issue/77102"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4342",
"url": "https://pkg.go.dev/vuln/GO-2026-4342"
}
],
"release_date": "2026-01-28T19:30:31.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-4427",
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-32286",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:59.226117+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a \"slice bounds out of range panic\", resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The PostgreSQL server multicluster-globalhub-manager connects to is either provisioned by the operator itself or specified by the admin managing the deployment. To successfully exploit the vulnerability in this context the attacker would need to compromise the operator-deployed PostgreSQL server to force a crafted malicious DataRow message or they would need to have the privileges required to modify the operator-provisioned deployment or configure globalhub-manager to use a compromised/malicious \u201cBYO Postgres\u201d server.\n\nThe first scenario (compromising a legitimate PostgreSQL server) would change Attack Complexity from Low to High resulting in an adjusted CVSS v3.1 score of 5.9 (Moderate)\nThe other scenarios (manipulating the operator provisioned-deployment or configuring the globalhub-manager to use a malicious server) would maintain AC:L but would require privileged access. This would change Privileges Required from None to High resulting in an adjusted CVSS v3.1 score of 4.9 (Moderate)\n\nBased on the above the Impact Rating for multicluster-globalhub-manager-rhel9 is Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "RHBZ#2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4518",
"url": "https://pkg.go.dev/vuln/GO-2026-4518"
}
],
"release_date": "2026-03-26T19:40:51.974000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:22733
Vulnerability from csaf_redhat - Published: 2026-06-03 11:39 - Updated: 2026-07-02 19:29The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22733",
"url": "https://access.redhat.com/errata/RHSA-2026:22733"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22733.json"
}
],
"title": "Red Hat Security Advisory: osbuild-composer security update",
"tracking": {
"current_release_date": "2026-07-02T19:29:59+00:00",
"generator": {
"date": "2026-07-02T19:29:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:22733",
"initial_release_date": "2026-06-03T11:39:06+00:00",
"revision_history": [
{
"date": "2026-06-03T11:39:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-03T11:39:06+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:29:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:9.4::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:101.3-4.el9_4.1.src",
"product": {
"name": "osbuild-composer-0:101.3-4.el9_4.1.src",
"product_id": "osbuild-composer-0:101.3-4.el9_4.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@101.3-4.el9_4.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:101.3-4.el9_4.1.aarch64",
"product": {
"name": "osbuild-composer-0:101.3-4.el9_4.1.aarch64",
"product_id": "osbuild-composer-0:101.3-4.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@101.3-4.el9_4.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.aarch64",
"product": {
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.aarch64",
"product_id": "osbuild-composer-core-0:101.3-4.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@101.3-4.el9_4.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64",
"product": {
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64",
"product_id": "osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@101.3-4.el9_4.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64",
"product": {
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64",
"product_id": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@101.3-4.el9_4.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product": {
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product_id": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@101.3-4.el9_4.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product": {
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product_id": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@101.3-4.el9_4.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product_id": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@101.3-4.el9_4.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product_id": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@101.3-4.el9_4.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:101.3-4.el9_4.1.ppc64le",
"product": {
"name": "osbuild-composer-0:101.3-4.el9_4.1.ppc64le",
"product_id": "osbuild-composer-0:101.3-4.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@101.3-4.el9_4.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le",
"product": {
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le",
"product_id": "osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@101.3-4.el9_4.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le",
"product": {
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le",
"product_id": "osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@101.3-4.el9_4.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le",
"product": {
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le",
"product_id": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@101.3-4.el9_4.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product": {
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product_id": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@101.3-4.el9_4.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product": {
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product_id": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@101.3-4.el9_4.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product_id": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@101.3-4.el9_4.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product_id": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@101.3-4.el9_4.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:101.3-4.el9_4.1.x86_64",
"product": {
"name": "osbuild-composer-0:101.3-4.el9_4.1.x86_64",
"product_id": "osbuild-composer-0:101.3-4.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@101.3-4.el9_4.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.x86_64",
"product": {
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.x86_64",
"product_id": "osbuild-composer-core-0:101.3-4.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@101.3-4.el9_4.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64",
"product": {
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64",
"product_id": "osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@101.3-4.el9_4.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64",
"product": {
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64",
"product_id": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@101.3-4.el9_4.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product": {
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product_id": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@101.3-4.el9_4.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product": {
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product_id": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@101.3-4.el9_4.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product_id": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@101.3-4.el9_4.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product_id": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@101.3-4.el9_4.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:101.3-4.el9_4.1.s390x",
"product": {
"name": "osbuild-composer-0:101.3-4.el9_4.1.s390x",
"product_id": "osbuild-composer-0:101.3-4.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@101.3-4.el9_4.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.s390x",
"product": {
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.s390x",
"product_id": "osbuild-composer-core-0:101.3-4.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@101.3-4.el9_4.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.s390x",
"product": {
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.s390x",
"product_id": "osbuild-composer-worker-0:101.3-4.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@101.3-4.el9_4.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x",
"product": {
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x",
"product_id": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@101.3-4.el9_4.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x",
"product": {
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x",
"product_id": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@101.3-4.el9_4.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x",
"product": {
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x",
"product_id": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@101.3-4.el9_4.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x",
"product_id": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@101.3-4.el9_4.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x",
"product_id": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@101.3-4.el9_4.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:101.3-4.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.aarch64"
},
"product_reference": "osbuild-composer-0:101.3-4.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:101.3-4.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.ppc64le"
},
"product_reference": "osbuild-composer-0:101.3-4.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:101.3-4.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.s390x"
},
"product_reference": "osbuild-composer-0:101.3-4.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:101.3-4.el9_4.1.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.src"
},
"product_reference": "osbuild-composer-0:101.3-4.el9_4.1.src",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:101.3-4.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.x86_64"
},
"product_reference": "osbuild-composer-0:101.3-4.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.aarch64"
},
"product_reference": "osbuild-composer-core-0:101.3-4.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le"
},
"product_reference": "osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.s390x"
},
"product_reference": "osbuild-composer-core-0:101.3-4.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:101.3-4.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.x86_64"
},
"product_reference": "osbuild-composer-core-0:101.3-4.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64"
},
"product_reference": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le"
},
"product_reference": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x"
},
"product_reference": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64"
},
"product_reference": "osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64"
},
"product_reference": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le"
},
"product_reference": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x"
},
"product_reference": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64"
},
"product_reference": "osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64"
},
"product_reference": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le"
},
"product_reference": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x"
},
"product_reference": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64"
},
"product_reference": "osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64"
},
"product_reference": "osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le"
},
"product_reference": "osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.s390x"
},
"product_reference": "osbuild-composer-worker-0:101.3-4.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64"
},
"product_reference": "osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)",
"product_id": "AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.src",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T11:39:06+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.src",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22733"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.src",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.src",
"AppStream-9.4.0.Z.E4S:osbuild-composer-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-core-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-debugsource-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-0:101.3-4.el9_4.1.x86_64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.aarch64",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.ppc64le",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.s390x",
"AppStream-9.4.0.Z.E4S:osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
}
]
}
RHSA-2026:22862
Vulnerability from csaf_redhat - Published: 2026-06-03 14:28 - Updated: 2026-07-02 19:29The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Workaround
|
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Workaround
|
A flaw was found in quinn-proto, a pure-Rust implementation of the IETF QUIC transport protocol. A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Workaround
|
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Workaround
|
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Workaround
|
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Logging for Red Hat OpenShift - 6.4.5",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Logging 6.4.5 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22862",
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-31812",
"url": "https://access.redhat.com/security/cve/CVE-2026-31812"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32829",
"url": "https://access.redhat.com/security/cve/CVE-2026-32829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33810",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22862.json"
}
],
"title": "Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.4.5",
"tracking": {
"current_release_date": "2026-07-02T19:29:59+00:00",
"generator": {
"date": "2026-07-02T19:29:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:22862",
"initial_release_date": "2026-06-03T14:28:38+00:00",
"revision_history": [
{
"date": "2026-06-03T14:28:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-03T14:28:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:29:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Logging Subsystem for Red Hat OpenShift 6.4",
"product": {
"name": "Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:logging:6.4::el9"
}
}
}
],
"category": "product_family",
"name": "Logging Subsystem for Red Hat OpenShift"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3Aed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1780051689"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-operator-bundle@sha256%3A2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=1780055531"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1780051630"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1780051809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3Af88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1780051656"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"product_id": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"product_identification_helper": {
"purl": "pkg:oci/loki-operator-bundle@sha256%3A236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-operator-bundle\u0026tag=1780055542"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1780051644"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Ab150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3Afac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1780052069"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1780051689"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1780051630"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1780051809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1780051656"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3Ae4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1780051644"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Ab1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1780052069"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1780051689"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3Ad840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1780051630"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3Aec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1780051809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3Ab3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1780051656"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1780051644"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Aee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3Af2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1780052069"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1780051689"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3Acbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1780051630"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1780051809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1780051656"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1780051644"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3A287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3Aba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1780052069"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4",
"product_id": "Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-31812",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-03-10T23:02:15.752133+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in quinn-proto, a pure-Rust implementation of the IETF QUIC transport protocol. A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The availability impact of this flaw is limited to specific services on Red Hat systems. Host system availability is not at risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-31812"
},
{
"category": "external",
"summary": "RHBZ#2446330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-31812",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31812"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31812",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31812"
},
{
"category": "external",
"summary": "https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98",
"url": "https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98"
}
],
"release_date": "2026-03-10T21:04:36.812000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32829",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"discovery_date": "2026-03-16T22:05:38.553414+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448271"
}
],
"notes": [
{
"category": "description",
"text": "lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 \"match copy operations,\" allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lz4_flex: lz4_flex\u0027s decompression can leak information from uninitialized memory or reused output buffer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In RHEL 9 and RHEL 10, this vulnerability presents minimal risk as the rust-analyzer component operates in a \"closed loop,\" strictly decompressing its own internal database. Because it does not process external or untrusted data, exploitation requires an attacker to already possess local access and sufficient privileges to tamper with the internal cache files on disk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32829"
},
{
"category": "external",
"summary": "RHBZ#2448271",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448271"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32829"
},
{
"category": "external",
"summary": "https://github.com/PSeitz/lz4_flex",
"url": "https://github.com/PSeitz/lz4_flex"
},
{
"category": "external",
"summary": "https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d",
"url": "https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d"
},
{
"category": "external",
"summary": "https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv",
"url": "https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv"
}
],
"release_date": "2026-03-16T20:48:08+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lz4_flex: lz4_flex\u0027s decompression can leak information from uninitialized memory or reused output buffer"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging Subsystem for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
}
]
}
RHSA-2026:22937
Vulnerability from csaf_redhat - Published: 2026-06-03 19:03 - Updated: 2026-07-02 22:08A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for image-builder is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.\n\nSecurity Fix(es):\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22937",
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "RHEL-179248",
"url": "https://issues.redhat.com/browse/RHEL-179248"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22937.json"
}
],
"title": "Red Hat Security Advisory: image-builder security update",
"tracking": {
"current_release_date": "2026-07-02T22:08:03+00:00",
"generator": {
"date": "2026-07-02T22:08:03+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:22937",
"initial_release_date": "2026-06-03T19:03:32+00:00",
"revision_history": [
{
"date": "2026-06-03T19:03:32+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-03T19:03:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T22:08:03+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el10_2.s390x",
"product": {
"name": "image-builder-0:52.1-1.el10_2.s390x",
"product_id": "image-builder-0:52.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el10_2.s390x",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.s390x",
"product_id": "image-builder-debugsource-0:52.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"product_id": "image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el10_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el10_2.x86_64",
"product": {
"name": "image-builder-0:52.1-1.el10_2.x86_64",
"product_id": "image-builder-0:52.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el10_2.x86_64",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.x86_64",
"product_id": "image-builder-debugsource-0:52.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"product_id": "image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el10_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el10_2.src",
"product": {
"name": "image-builder-0:52.1-1.el10_2.src",
"product_id": "image-builder-0:52.1-1.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el10_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el10_2.aarch64",
"product": {
"name": "image-builder-0:52.1-1.el10_2.aarch64",
"product_id": "image-builder-0:52.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"product_id": "image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"product_id": "image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el10_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el10_2.ppc64le",
"product": {
"name": "image-builder-0:52.1-1.el10_2.ppc64le",
"product_id": "image-builder-0:52.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"product_id": "image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"product_id": "image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el10_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64"
},
"product_reference": "image-builder-0:52.1-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le"
},
"product_reference": "image-builder-0:52.1-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x"
},
"product_reference": "image-builder-0:52.1-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src"
},
"product_reference": "image-builder-0:52.1-1.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64"
},
"product_reference": "image-builder-0:52.1-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:23228
Vulnerability from csaf_redhat - Published: 2026-06-04 13:27 - Updated: 2026-07-02 22:08A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for image-builder is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.\n\nSecurity Fix(es):\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:23228",
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "RHEL-141689",
"url": "https://issues.redhat.com/browse/RHEL-141689"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23228.json"
}
],
"title": "Red Hat Security Advisory: image-builder security update",
"tracking": {
"current_release_date": "2026-07-02T22:08:03+00:00",
"generator": {
"date": "2026-07-02T22:08:03+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:23228",
"initial_release_date": "2026-06-04T13:27:44+00:00",
"revision_history": [
{
"date": "2026-06-04T13:27:44+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-04T13:27:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T22:08:03+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el9_8.x86_64",
"product": {
"name": "image-builder-0:52.1-1.el9_8.x86_64",
"product_id": "image-builder-0:52.1-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el9_8.x86_64",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.x86_64",
"product_id": "image-builder-debugsource-0:52.1-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"product_id": "image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el9_8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el9_8.src",
"product": {
"name": "image-builder-0:52.1-1.el9_8.src",
"product_id": "image-builder-0:52.1-1.el9_8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el9_8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el9_8.aarch64",
"product": {
"name": "image-builder-0:52.1-1.el9_8.aarch64",
"product_id": "image-builder-0:52.1-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"product_id": "image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"product_id": "image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el9_8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el9_8.ppc64le",
"product": {
"name": "image-builder-0:52.1-1.el9_8.ppc64le",
"product_id": "image-builder-0:52.1-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"product_id": "image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"product_id": "image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el9_8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el9_8.s390x",
"product": {
"name": "image-builder-0:52.1-1.el9_8.s390x",
"product_id": "image-builder-0:52.1-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el9_8.s390x",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.s390x",
"product_id": "image-builder-debugsource-0:52.1-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"product_id": "image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el9_8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64"
},
"product_reference": "image-builder-0:52.1-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le"
},
"product_reference": "image-builder-0:52.1-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x"
},
"product_reference": "image-builder-0:52.1-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src"
},
"product_reference": "image-builder-0:52.1-1.el9_8.src",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64"
},
"product_reference": "image-builder-0:52.1-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:23345
Vulnerability from csaf_redhat - Published: 2026-06-04 14:16 - Updated: 2026-07-02 22:08No description is available for this CVE.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Tempo. A remote attacker can exploit this vulnerability by sending large queries to the Tempo service. This can lead to excessive memory allocations, potentially causing a Denial of Service (DoS) by impacting the availability of the service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in NATS-Server, a high-performance messaging system. A remote attacker can exploit this vulnerability before authentication by sending a specially crafted WebSockets frame. This missing sanity check can trigger a server panic, leading to a Denial of Service (DoS) for affected deployments that use WebSockets and expose the network port to untrusted endpoints.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in NATS-Server. A remote attacker can exploit this vulnerability by connecting to a NATS-Server instance where the 'leafnode' configuration is enabled and compression is active. This pre-authentication flaw allows the attacker to trigger a server crash, resulting in a Denial of Service (DoS) for the affected system.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in github.com/buger/jsonparser. The Delete function, when processing malformed JSON input, fails to properly validate offsets. This vulnerability can lead to a negative slice index and a runtime panic, allowing a remote attacker to cause a denial of service (DoS) by providing specially crafted JSON data.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
A flaw was found in NATS-Server. A remote attacker could exploit this vulnerability by manipulating MQTT (Message Queuing Telemetry Transport) Client IDs. This malfeasance allows for the hijacking of client sessions and messages. This could lead to unauthorized access to sensitive information or disruption of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in NATS-Server, a high-performance server for the NATS.io messaging system. For MQTT deployments utilizing usercodes and passwords, the MQTT passwords were mistakenly categorized as non-authenticating identity statements (JSON Web Tokens - JWT). This misclassification leads to the exposure of these passwords through monitoring endpoints, enabling an attacker with access to these endpoints to gain sensitive information.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in NATS-Server. When Access Control Lists (ACLs) were configured for message subjects, these controls were not correctly applied within the `$MQTT.>` namespace. This oversight allows MQTT clients to bypass the intended ACL checks, potentially granting unauthorized access to sensitive message subjects. This vulnerability could lead to information disclosure or unauthorized message manipulation.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in NATS-Server, a high-performance messaging system. A remote attacker, by connecting to the leafnode port and sending a specially crafted malformed message before authentication, can cause the nats-server to crash. This vulnerability leads to a Denial of Service (DoS), making the server unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in NATS-Server. A malicious client connecting to the WebSockets port can cause unbounded memory use before authentication by sending a large amount of data. This resource exhaustion vulnerability can lead to a Denial of Service (DoS) for the server, making it unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in NATS-Server. If the NATS-Server is configured with static credentials provided through command-line arguments (argv) and the monitoring port is enabled, a remote attacker with access to the monitoring port can view these credentials. The /debug/vars endpoint on the monitoring port exposes an unredacted copy of the command-line arguments, leading to information disclosure of sensitive authentication details.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in etcd, a distributed key-value store. Unauthorized users can bypass authentication or authorization checks when the gRPC API is exposed to untrusted clients. This allows them to access sensitive cluster topology information, disrupt operations through alarms, interfere with lease management, and trigger data compaction, leading to permanent data loss and disruption of critical workflows. This vulnerability can result in information disclosure and denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in goxmlsig, a Go library for XML Digital Signatures. This vulnerability arises from a programming error, specifically a loop variable capture issue, within the `validateSignature` function. When processing XML Digital Signatures, this error can cause the system to incorrectly validate the signature, potentially allowing an attacker to bypass integrity checks. This issue affects Go versions before 1.22 or projects using older `go.mod` configurations.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in golang.org/x/image. A remote attacker could exploit this vulnerability by providing a specially crafted WEBP image with an invalid, large size. This could cause the application to panic and crash on 32-bit platforms, leading to a Denial of Service (DoS).
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Moby, an open-source container framework. This vulnerability allows for a privilege validation bypass during `docker plugin install`. Due to an error in the daemon's privilege comparison logic, the system may incorrectly accept a plugin's requested privileges that differ from those approved by the user. This could lead to unauthorized privilege escalation for installed plugins.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Moby, an open-source container framework. This security vulnerability allows attackers to bypass authorization plugins (AuthZ), which are mechanisms designed to control access and permissions within the container environment. The bypass of these plugins can lead to unauthorized operations and potential compromise of the system's integrity and confidentiality.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in github.com/gomarkdown/markdown, a Go library for parsing Markdown text and rendering as HTML. A remote attacker could exploit this vulnerability by providing a specially crafted malformed input. Specifically, input containing a '<' character not followed by a '>' character, when processed by the SmartypantsRenderer, can lead to an out-of-bounds read or a panic. This can result in a denial of service (DoS) for the application, making it unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Apache Thrift. This vulnerability involves improper validation of server certificates, where the hostname presented in the certificate does not match the expected hostname. A remote attacker could exploit this to impersonate a legitimate server, potentially intercepting or altering sensitive communications and leading to unauthorized access or information disclosure.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Apache Thrift. This out-of-bounds read vulnerability could allow an attacker to access memory outside of allocated bounds. This could lead to information disclosure or potentially a denial of service (DoS) condition.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Apache Thrift. This integer overflow or wraparound vulnerability could potentially lead to unexpected behavior or resource exhaustion, which may impact the availability or integrity of the system. The exact consequences depend on how the overflow is triggered and handled within the application.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability exists, which could allow a remote attacker to trigger a Denial of Service (DoS) condition. This occurs when the affected component processes specially crafted input, leading to excessive resource consumption and system unavailability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Apache Thrift. This out-of-bounds read vulnerability can lead to the disclosure of sensitive information or a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Apache Thrift. This vulnerability involves improper validation of a certificate with a host mismatch, which could allow a remote attacker to bypass security checks. By presenting a specially crafted certificate, an attacker may impersonate a legitimate server or client. This could lead to a security bypass, potentially enabling unauthorized access or information disclosure.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multicluster Global Hub v1.6.2 general availability release images, which provide security fixes, bug fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact of Important. \nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:23345",
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32283",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32285",
"url": "https://access.redhat.com/security/cve/CVE-2026-32285"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32286",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33215",
"url": "https://access.redhat.com/security/cve/CVE-2026-33215"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33216",
"url": "https://access.redhat.com/security/cve/CVE-2026-33216"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33217",
"url": "https://access.redhat.com/security/cve/CVE-2026-33217"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33218",
"url": "https://access.redhat.com/security/cve/CVE-2026-33218"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33219",
"url": "https://access.redhat.com/security/cve/CVE-2026-33219"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33247",
"url": "https://access.redhat.com/security/cve/CVE-2026-33247"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33413",
"url": "https://access.redhat.com/security/cve/CVE-2026-33413"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33487",
"url": "https://access.redhat.com/security/cve/CVE-2026-33487"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33810",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33813",
"url": "https://access.redhat.com/security/cve/CVE-2026-33813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33997",
"url": "https://access.redhat.com/security/cve/CVE-2026-33997"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34040",
"url": "https://access.redhat.com/security/cve/CVE-2026-34040"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40890",
"url": "https://access.redhat.com/security/cve/CVE-2026-40890"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41602",
"url": "https://access.redhat.com/security/cve/CVE-2026-41602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41603",
"url": "https://access.redhat.com/security/cve/CVE-2026-41603"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41604",
"url": "https://access.redhat.com/security/cve/CVE-2026-41604"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41605",
"url": "https://access.redhat.com/security/cve/CVE-2026-41605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41606",
"url": "https://access.redhat.com/security/cve/CVE-2026-41606"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41607",
"url": "https://access.redhat.com/security/cve/CVE-2026-41607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41636",
"url": "https://access.redhat.com/security/cve/CVE-2026-41636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-43869",
"url": "https://access.redhat.com/security/cve/CVE-2026-43869"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4427",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-21728",
"url": "https://access.redhat.com/security/cve/CVE-2026-21728"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27889",
"url": "https://access.redhat.com/security/cve/CVE-2026-27889"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29785",
"url": "https://access.redhat.com/security/cve/CVE-2026-29785"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23345.json"
}
],
"title": "Red Hat Security Advisory: Multicluster Global Hub 1.6.2 security update",
"tracking": {
"current_release_date": "2026-07-02T22:08:05+00:00",
"generator": {
"date": "2026-07-02T22:08:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:23345",
"initial_release_date": "2026-06-04T14:16:54+00:00",
"revision_history": [
{
"date": "2026-06-04T14:16:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-04T14:17:04+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T22:08:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Multicluster Global Hub 1.6.2",
"product": {
"name": "Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:multicluster_globalhub:1.6::el9"
}
}
}
],
"category": "product_family",
"name": "Multicluster Global Hub"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1780167118"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1780320809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1780321673"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-operator-bundle@sha256%3A51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle\u0026tag=1780370487"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779839087"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779839762"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1780167118"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1780320809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Aa1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1780321673"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Ad8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779839087"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779839762"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1780167118"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1780320809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1780321673"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Af9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779839087"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Aff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779839762"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1780167118"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3Aba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1780320809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Af2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1780321673"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779839087"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779839762"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4427",
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-21728",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T09:00:58.144273+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461395"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tempo. A remote attacker can exploit this vulnerability by sending large queries to the Tempo service. This can lead to excessive memory allocations, potentially causing a Denial of Service (DoS) by impacting the availability of the service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana/tempo: Tempo: Denial of Service via large queries",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-21728"
},
{
"category": "external",
"summary": "RHBZ#2461395",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461395"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-21728",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21728"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2026-21728",
"url": "https://grafana.com/security/security-advisories/cve-2026-21728"
}
],
"release_date": "2026-04-24T08:00:47.074000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "grafana/tempo: Tempo: Denial of Service via large queries"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-27889",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-25T20:01:58.261703+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451447"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server, a high-performance messaging system. A remote attacker can exploit this vulnerability before authentication by sending a specially crafted WebSockets frame. This missing sanity check can trigger a server panic, leading to a Denial of Service (DoS) for affected deployments that use WebSockets and expose the network port to untrusted endpoints.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27889"
},
{
"category": "external",
"summary": "RHBZ#2451447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451447"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27889",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27889"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27889",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27889"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-03.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-03.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-pq2q-rcw4-3hr6",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-pq2q-rcw4-3hr6"
}
],
"release_date": "2026-03-25T19:36:36.370000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame"
},
{
"cve": "CVE-2026-29785",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-03-25T20:01:35.121898+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451444"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server. A remote attacker can exploit this vulnerability by connecting to a NATS-Server instance where the \u0027leafnode\u0027 configuration is enabled and compression is active. This pre-authentication flaw allows the attacker to trigger a server crash, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29785"
},
{
"category": "external",
"summary": "RHBZ#2451444",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451444"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29785",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29785"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29785",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29785"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-04.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-04.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/commit/a1488de6f2ba6e666aef0f9cce0016f7f167d6a8",
"url": "https://github.com/nats-io/nats-server/commit/a1488de6f2ba6e666aef0f9cce0016f7f167d6a8"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-52jh-2xxh-pwh6",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-52jh-2xxh-pwh6"
}
],
"release_date": "2026-03-25T19:38:44.587000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-32285",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:54.925687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451846"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/buger/jsonparser. The Delete function, when processing malformed JSON input, fails to properly validate offsets. This vulnerability can lead to a negative slice index and a runtime panic, allowing a remote attacker to cause a denial of service (DoS) by providing specially crafted JSON data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32285"
},
{
"category": "external",
"summary": "RHBZ#2451846",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451846"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32285"
},
{
"category": "external",
"summary": "https://github.com/buger/jsonparser/issues/275",
"url": "https://github.com/buger/jsonparser/issues/275"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4514",
"url": "https://github.com/golang/vulndb/issues/4514"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4514",
"url": "https://pkg.go.dev/vuln/GO-2026-4514"
}
],
"release_date": "2026-03-26T19:40:51.837000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input"
},
{
"cve": "CVE-2026-32286",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:59.226117+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a \"slice bounds out of range panic\", resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The PostgreSQL server multicluster-globalhub-manager connects to is either provisioned by the operator itself or specified by the admin managing the deployment. To successfully exploit the vulnerability in this context the attacker would need to compromise the operator-deployed PostgreSQL server to force a crafted malicious DataRow message or they would need to have the privileges required to modify the operator-provisioned deployment or configure globalhub-manager to use a compromised/malicious \u201cBYO Postgres\u201d server.\n\nThe first scenario (compromising a legitimate PostgreSQL server) would change Attack Complexity from Low to High resulting in an adjusted CVSS v3.1 score of 5.9 (Moderate)\nThe other scenarios (manipulating the operator provisioned-deployment or configuring the globalhub-manager to use a malicious server) would maintain AC:L but would require privileged access. This would change Privileges Required from None to High resulting in an adjusted CVSS v3.1 score of 4.9 (Moderate)\n\nBased on the above the Impact Rating for multicluster-globalhub-manager-rhel9 is Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "RHBZ#2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4518",
"url": "https://pkg.go.dev/vuln/GO-2026-4518"
}
],
"release_date": "2026-03-26T19:40:51.974000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33215",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2026-03-24T22:01:19.032191+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451021"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server. A remote attacker could exploit this vulnerability by manipulating MQTT (Message Queuing Telemetry Transport) Client IDs. This malfeasance allows for the hijacking of client sessions and messages. This could lead to unauthorized access to sensitive information or disruption of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33215"
},
{
"category": "external",
"summary": "RHBZ#2451021",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451021"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33215"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33215",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33215"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-06.tx",
"url": "https://advisories.nats.io/CVE/secnote-2026-06.tx"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879"
}
],
"release_date": "2026-03-24T20:55:53.455000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance"
},
{
"cve": "CVE-2026-33216",
"cwe": {
"id": "CWE-213",
"name": "Exposure of Sensitive Information Due to Incompatible Policies"
},
"discovery_date": "2026-03-25T20:02:03.000174+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server, a high-performance server for the NATS.io messaging system. For MQTT deployments utilizing usercodes and passwords, the MQTT passwords were mistakenly categorized as non-authenticating identity statements (JSON Web Tokens - JWT). This misclassification leads to the exposure of these passwords through monitoring endpoints, enabling an attacker with access to these endpoints to gain sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33216"
},
{
"category": "external",
"summary": "RHBZ#2451448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33216"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33216",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33216"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-05.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-05.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099",
"url": "https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc"
}
],
"release_date": "2026-03-25T19:41:55.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints"
},
{
"cve": "CVE-2026-33217",
"cwe": {
"id": "CWE-425",
"name": "Direct Request (\u0027Forced Browsing\u0027)"
},
"discovery_date": "2026-03-25T20:01:47.815937+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451446"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server. When Access Control Lists (ACLs) were configured for message subjects, these controls were not correctly applied within the `$MQTT.\u003e` namespace. This oversight allows MQTT clients to bypass the intended ACL checks, potentially granting unauthorized access to sensitive message subjects. This vulnerability could lead to information disclosure or unauthorized message manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33217"
},
{
"category": "external",
"summary": "RHBZ#2451446",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451446"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33217"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33217",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33217"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-07.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-07.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-jxxm-27vp-c3m5",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-jxxm-27vp-c3m5"
}
],
"release_date": "2026-03-25T19:43:40.969000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace"
},
{
"cve": "CVE-2026-33218",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-25T20:02:13.680355+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server, a high-performance messaging system. A remote attacker, by connecting to the leafnode port and sending a specially crafted malformed message before authentication, can cause the nats-server to crash. This vulnerability leads to a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed message pre-authentication on leafnode port",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33218"
},
{
"category": "external",
"summary": "RHBZ#2451450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33218"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33218",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33218"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-10.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-10.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339"
}
],
"release_date": "2026-03-25T19:53:12.075000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed message pre-authentication on leafnode port"
},
{
"cve": "CVE-2026-33219",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-03-25T20:01:41.235854+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451445"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server. A malicious client connecting to the WebSockets port can cause unbounded memory use before authentication by sending a large amount of data. This resource exhaustion vulnerability can lead to a Denial of Service (DoS) for the server, making it unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via unbounded memory use in WebSockets",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33219"
},
{
"category": "external",
"summary": "RHBZ#2451445",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451445"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33219"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33219",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33219"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-02.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-02.txt"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-11.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-11.txt"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-qrvq-68c2-7grw",
"url": "https://github.com/advisories/GHSA-qrvq-68c2-7grw"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-8r68-gvr4-jh7j",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-8r68-gvr4-jh7j"
}
],
"release_date": "2026-03-25T19:55:28.363000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via unbounded memory use in WebSockets"
},
{
"cve": "CVE-2026-33247",
"cwe": {
"id": "CWE-214",
"name": "Invocation of Process Using Visible Sensitive Information"
},
"discovery_date": "2026-03-25T21:02:07.985713+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451486"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server. If the NATS-Server is configured with static credentials provided through command-line arguments (argv) and the monitoring port is enabled, a remote attacker with access to the monitoring port can view these credentials. The /debug/vars endpoint on the monitoring port exposes an unredacted copy of the command-line arguments, leading to information disclosure of sensitive authentication details.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/nats-io/nats-server: NATS-Server: Information disclosure of credentials via monitoring port and command-line arguments",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33247"
},
{
"category": "external",
"summary": "RHBZ#2451486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451486"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33247"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33247",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33247"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-14.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-14.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-x6g4-f6q3-fqvv",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-x6g4-f6q3-fqvv"
}
],
"release_date": "2026-03-25T20:02:18.868000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/nats-io/nats-server: NATS-Server: Information disclosure of credentials via monitoring port and command-line arguments"
},
{
"cve": "CVE-2026-33413",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-03-26T14:03:01.896580+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451728"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in etcd, a distributed key-value store. Unauthorized users can bypass authentication or authorization checks when the gRPC API is exposed to untrusted clients. This allows them to access sensitive cluster topology information, disrupt operations through alarms, interfere with lease management, and trigger data compaction, leading to permanent data loss and disruption of critical workflows. This vulnerability can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "etcd: etcd: Authorization bypass allows information disclosure and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in etcd allows unauthorized users to bypass authentication or authorization checks when the gRPC API is exposed to untrusted clients and etcd\u0027s built-in authentication is enabled. This can lead to information disclosure and denial of service. Typical Red Hat OpenShift Container Platform and Kubernetes deployments are not affected, as the Kubernetes API server handles authentication and authorization independently of etcd\u0027s internal mechanisms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33413"
},
{
"category": "external",
"summary": "RHBZ#2451728",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451728"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33413"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33413",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33413"
},
{
"category": "external",
"summary": "https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg",
"url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg"
}
],
"release_date": "2026-03-26T13:36:10.919000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Restrict network access to etcd server ports to ensure only trusted components can establish connections. Implement strong client identity at the transport layer, such as mTLS, with tightly scoped client certificate distribution. This will limit unauthorized access to etcd functions.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "etcd: etcd: Authorization bypass allows information disclosure and denial of service"
},
{
"cve": "CVE-2026-33487",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-26T18:02:32.278778+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451814"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in goxmlsig, a Go library for XML Digital Signatures. This vulnerability arises from a programming error, specifically a loop variable capture issue, within the `validateSignature` function. When processing XML Digital Signatures, this error can cause the system to incorrectly validate the signature, potentially allowing an attacker to bypass integrity checks. This issue affects Go versions before 1.22 or projects using older `go.mod` configurations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33487"
},
{
"category": "external",
"summary": "RHBZ#2451814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33487"
},
{
"category": "external",
"summary": "https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc",
"url": "https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc"
}
],
"release_date": "2026-03-26T17:17:51.101000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
},
{
"cve": "CVE-2026-33813",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-21T20:01:02.224363+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460221"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/image. A remote attacker could exploit this vulnerability by providing a specially crafted WEBP image with an invalid, large size. This could cause the application to panic and crash on 32-bit platforms, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33813"
},
{
"category": "external",
"summary": "RHBZ#2460221",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460221"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33813",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33813"
},
{
"category": "external",
"summary": "https://go.dev/cl/759860",
"url": "https://go.dev/cl/759860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78407",
"url": "https://go.dev/issue/78407"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4961",
"url": "https://pkg.go.dev/vuln/GO-2026-4961"
}
],
"release_date": "2026-04-21T19:21:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing"
},
{
"cve": "CVE-2026-33997",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-03-31T03:01:29.529297+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453277"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Moby, an open-source container framework. This vulnerability allows for a privilege validation bypass during `docker plugin install`. Due to an error in the daemon\u0027s privilege comparison logic, the system may incorrectly accept a plugin\u0027s requested privileges that differ from those approved by the user. This could lead to unauthorized privilege escalation for installed plugins.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An important flaw in Moby, an open-source container framework, allows for a privilege validation bypass during `docker plugin install`. This issue stems from an error in the daemon\u0027s privilege comparison logic, which could lead to unauthorized privilege escalation for installed plugins. Red Hat products that leverage Moby and allow Docker plugin installation are affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33997"
},
{
"category": "external",
"summary": "RHBZ#2453277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33997",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33997"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33997",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33997"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/releases/tag/docker-v29.3.1",
"url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9",
"url": "https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9"
}
],
"release_date": "2026-03-31T01:36:51.404000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation"
},
{
"cve": "CVE-2026-34040",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-03-31T03:01:34.530713+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453278"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Moby, an open-source container framework. This security vulnerability allows attackers to bypass authorization plugins (AuthZ), which are mechanisms designed to control access and permissions within the container environment. The bypass of these plugins can lead to unauthorized operations and potential compromise of the system\u0027s integrity and confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Moby: Moby: Authorization bypass vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34040"
},
{
"category": "external",
"summary": "RHBZ#2453278",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453278"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34040",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34040"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34040",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34040"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/releases/tag/docker-v29.3.1",
"url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2",
"url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"
}
],
"release_date": "2026-03-31T01:36:48.205000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Moby: Moby: Authorization bypass vulnerability"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-40890",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-04-21T20:02:56.729456+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460245"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/gomarkdown/markdown, a Go library for parsing Markdown text and rendering as HTML. A remote attacker could exploit this vulnerability by providing a specially crafted malformed input. Specifically, input containing a \u0027\u003c\u0027 character not followed by a \u0027\u003e\u0027 character, when processed by the SmartypantsRenderer, can lead to an out-of-bounds read or a panic. This can result in a denial of service (DoS) for the application, making it unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via malformed Markdown input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw affecting Red Hat products that utilize the `github.com/gomarkdown/markdown` library. The vulnerability occurs when the `SmartypantsRenderer` processes specially crafted malformed Markdown input containing an unclosed \u0027\u003c\u0027 character, leading to an out-of-bounds read or application panic. A successful exploitation may lead the application using the library unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40890"
},
{
"category": "external",
"summary": "RHBZ#2460245",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460245"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40890"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40890",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40890"
},
{
"category": "external",
"summary": "https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778",
"url": "https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778"
},
{
"category": "external",
"summary": "https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7",
"url": "https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7"
}
],
"release_date": "2026-04-21T19:51:53.237000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via malformed Markdown input"
},
{
"cve": "CVE-2026-41602",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-28T10:01:16.099816+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463407"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41602"
},
{
"category": "external",
"summary": "RHBZ#2463407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463407"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/6",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/6"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:19:06.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation"
},
{
"cve": "CVE-2026-41603",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-04-28T10:01:29.782287+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463411"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability involves improper validation of server certificates, where the hostname presented in the certificate does not match the expected hostname. A remote attacker could exploit this to impersonate a legitimate server, potentially intercepting or altering sensitive communications and leading to unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41603"
},
{
"category": "external",
"summary": "RHBZ#2463411",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463411"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/7",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/7"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:19:40.564000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation"
},
{
"cve": "CVE-2026-41604",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-28T10:01:47.903741+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463416"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This out-of-bounds read vulnerability could allow an attacker to access memory outside of allocated bounds. This could lead to information disclosure or potentially a denial of service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41604"
},
{
"category": "external",
"summary": "RHBZ#2463416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41604"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41604",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41604"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/5",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/5"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:20:13.996000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability"
},
{
"cve": "CVE-2026-41605",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-28T10:01:54.269412+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463418"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This integer overflow or wraparound vulnerability could potentially lead to unexpected behavior or resource exhaustion, which may impact the availability or integrity of the system. The exact consequences depend on how the overflow is triggered and handled within the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41605"
},
{
"category": "external",
"summary": "RHBZ#2463418",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463418"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41605"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/4",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:20:44.319000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability"
},
{
"cve": "CVE-2026-41606",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-04-28T10:01:19.136351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463408"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability exists, which could allow a remote attacker to trigger a Denial of Service (DoS) condition. This occurs when the affected component processes specially crafted input, leading to excessive resource consumption and system unavailability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41606"
},
{
"category": "external",
"summary": "RHBZ#2463408",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463408"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41606"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41606",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41606"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/3",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:21:12.815000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion"
},
{
"cve": "CVE-2026-41607",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-28T10:01:33.022623+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463412"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This out-of-bounds read vulnerability can lead to the disclosure of sensitive information or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41607"
},
{
"category": "external",
"summary": "RHBZ#2463412",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463412"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41607"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/2",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/2"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:21:48.502000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability"
},
{
"cve": "CVE-2026-41636",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-04-28T10:01:03.992199+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463404"
}
],
"notes": [
{
"category": "description",
"text": "Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41636"
},
{
"category": "external",
"summary": "RHBZ#2463404",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463404"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41636"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/1",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:22:14.639000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion"
},
{
"cve": "CVE-2026-43869",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-05T08:00:56.417384+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466660"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability involves improper validation of a certificate with a host mismatch, which could allow a remote attacker to bypass security checks. By presenting a specially crafted certificate, an attacker may impersonate a legitimate server or client. This could lead to a security bypass, potentially enabling unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: Apache Thrift: Security bypass due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43869"
},
{
"category": "external",
"summary": "RHBZ#2466660",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466660"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43869"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43869",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43869"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/3hsgl1b69wzq3ry39scqbv2dhyl3j52r",
"url": "https://lists.apache.org/thread/3hsgl1b69wzq3ry39scqbv2dhyl3j52r"
}
],
"release_date": "2026-05-05T07:25:48.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: Apache Thrift: Security bypass due to improper certificate validation"
}
]
}
RHSA-2026:24386
Vulnerability from csaf_redhat - Published: 2026-06-08 13:14 - Updated: 2026-07-02 19:29The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-docker-7:5.8.2-2.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for podman is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fix(es):\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:24386",
"url": "https://access.redhat.com/errata/RHSA-2026:24386"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24386.json"
}
],
"title": "Red Hat Security Advisory: podman security update",
"tracking": {
"current_release_date": "2026-07-02T19:29:59+00:00",
"generator": {
"date": "2026-07-02T19:29:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:24386",
"initial_release_date": "2026-06-08T13:14:01+00:00",
"revision_history": [
{
"date": "2026-06-08T13:14:01+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-08T13:14:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:29:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "podman-7:5.8.2-2.el10_2.src",
"product": {
"name": "podman-7:5.8.2-2.el10_2.src",
"product_id": "podman-7:5.8.2-2.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman@5.8.2-2.el10_2?arch=src\u0026epoch=7"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "podman-7:5.8.2-2.el10_2.aarch64",
"product": {
"name": "podman-7:5.8.2-2.el10_2.aarch64",
"product_id": "podman-7:5.8.2-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman@5.8.2-2.el10_2?arch=aarch64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-remote-7:5.8.2-2.el10_2.aarch64",
"product": {
"name": "podman-remote-7:5.8.2-2.el10_2.aarch64",
"product_id": "podman-remote-7:5.8.2-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-remote@5.8.2-2.el10_2?arch=aarch64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"product": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"product_id": "podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-debugsource@5.8.2-2.el10_2?arch=aarch64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"product": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"product_id": "podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-debuginfo@5.8.2-2.el10_2?arch=aarch64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"product": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"product_id": "podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.8.2-2.el10_2?arch=aarch64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"product": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"product_id": "podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.8.2-2.el10_2?arch=aarch64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-tests-7:5.8.2-2.el10_2.aarch64",
"product": {
"name": "podman-tests-7:5.8.2-2.el10_2.aarch64",
"product_id": "podman-tests-7:5.8.2-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-tests@5.8.2-2.el10_2?arch=aarch64\u0026epoch=7"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "podman-7:5.8.2-2.el10_2.ppc64le",
"product": {
"name": "podman-7:5.8.2-2.el10_2.ppc64le",
"product_id": "podman-7:5.8.2-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman@5.8.2-2.el10_2?arch=ppc64le\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-remote-7:5.8.2-2.el10_2.ppc64le",
"product": {
"name": "podman-remote-7:5.8.2-2.el10_2.ppc64le",
"product_id": "podman-remote-7:5.8.2-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-remote@5.8.2-2.el10_2?arch=ppc64le\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"product": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"product_id": "podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-debugsource@5.8.2-2.el10_2?arch=ppc64le\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"product": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"product_id": "podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-debuginfo@5.8.2-2.el10_2?arch=ppc64le\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"product": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"product_id": "podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.8.2-2.el10_2?arch=ppc64le\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"product": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"product_id": "podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.8.2-2.el10_2?arch=ppc64le\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-tests-7:5.8.2-2.el10_2.ppc64le",
"product": {
"name": "podman-tests-7:5.8.2-2.el10_2.ppc64le",
"product_id": "podman-tests-7:5.8.2-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-tests@5.8.2-2.el10_2?arch=ppc64le\u0026epoch=7"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "podman-7:5.8.2-2.el10_2.s390x",
"product": {
"name": "podman-7:5.8.2-2.el10_2.s390x",
"product_id": "podman-7:5.8.2-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman@5.8.2-2.el10_2?arch=s390x\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-remote-7:5.8.2-2.el10_2.s390x",
"product": {
"name": "podman-remote-7:5.8.2-2.el10_2.s390x",
"product_id": "podman-remote-7:5.8.2-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-remote@5.8.2-2.el10_2?arch=s390x\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-debugsource-7:5.8.2-2.el10_2.s390x",
"product": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.s390x",
"product_id": "podman-debugsource-7:5.8.2-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-debugsource@5.8.2-2.el10_2?arch=s390x\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"product": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"product_id": "podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-debuginfo@5.8.2-2.el10_2?arch=s390x\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"product": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"product_id": "podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.8.2-2.el10_2?arch=s390x\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"product": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"product_id": "podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.8.2-2.el10_2?arch=s390x\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-tests-7:5.8.2-2.el10_2.s390x",
"product": {
"name": "podman-tests-7:5.8.2-2.el10_2.s390x",
"product_id": "podman-tests-7:5.8.2-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-tests@5.8.2-2.el10_2?arch=s390x\u0026epoch=7"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "podman-7:5.8.2-2.el10_2.x86_64",
"product": {
"name": "podman-7:5.8.2-2.el10_2.x86_64",
"product_id": "podman-7:5.8.2-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman@5.8.2-2.el10_2?arch=x86_64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-remote-7:5.8.2-2.el10_2.x86_64",
"product": {
"name": "podman-remote-7:5.8.2-2.el10_2.x86_64",
"product_id": "podman-remote-7:5.8.2-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-remote@5.8.2-2.el10_2?arch=x86_64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"product": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"product_id": "podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-debugsource@5.8.2-2.el10_2?arch=x86_64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"product": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"product_id": "podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-debuginfo@5.8.2-2.el10_2?arch=x86_64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"product": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"product_id": "podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.8.2-2.el10_2?arch=x86_64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64",
"product": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64",
"product_id": "podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.8.2-2.el10_2?arch=x86_64\u0026epoch=7"
}
}
},
{
"category": "product_version",
"name": "podman-tests-7:5.8.2-2.el10_2.x86_64",
"product": {
"name": "podman-tests-7:5.8.2-2.el10_2.x86_64",
"product_id": "podman-tests-7:5.8.2-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-tests@5.8.2-2.el10_2?arch=x86_64\u0026epoch=7"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "podman-docker-7:5.8.2-2.el10_2.noarch",
"product": {
"name": "podman-docker-7:5.8.2-2.el10_2.noarch",
"product_id": "podman-docker-7:5.8.2-2.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/podman-docker@5.8.2-2.el10_2?arch=noarch\u0026epoch=7"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-7:5.8.2-2.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.src"
},
"product_reference": "podman-7:5.8.2-2.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-debugsource-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-docker-7:5.8.2-2.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-docker-7:5.8.2-2.el10_2.noarch"
},
"product_reference": "podman-docker-7:5.8.2-2.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-remote-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-remote-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-remote-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-remote-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debuginfo-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-debugsource-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-debugsource-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-tests-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-tests-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-tests-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-tests-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64"
},
"product_reference": "podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le"
},
"product_reference": "podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x"
},
"product_reference": "podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64"
},
"product_reference": "podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.src",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-docker-7:5.8.2-2.el10_2.noarch",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-08T13:14:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.src",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-docker-7:5.8.2-2.el10_2.noarch",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24386"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.src",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-docker-7:5.8.2-2.el10_2.noarch",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.src",
"AppStream-10.2.Z:podman-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-docker-7:5.8.2-2.el10_2.noarch",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-remote-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-debugsource-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-tests-7:5.8.2-2.el10_2.x86_64",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.aarch64",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.ppc64le",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.s390x",
"CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
}
]
}
RHSA-2026:24853
Vulnerability from csaf_redhat - Published: 2026-06-09 15:31 - Updated: 2026-07-02 22:08A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application's internal network, potentially leading to the disclosure of sensitive information.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
No description is available for this CVE.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker's key, allowing them to bypass authentication and gain unauthorized access.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user's in-progress image upload.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service (DoS) by providing a specially crafted FITS image file. The library's failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory consumption, causing the system to crash or experience severe performance issues.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application's core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution "Gadget" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x | — |
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.15.5 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.15.5",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:24853",
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2377",
"url": "https://access.redhat.com/security/cve/CVE-2026-2377"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27962",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32286",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32589",
"url": "https://access.redhat.com/security/cve/CVE-2026-32589"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32590",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33894",
"url": "https://access.redhat.com/security/cve/CVE-2026-33894"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39892",
"url": "https://access.redhat.com/security/cve/CVE-2026-39892"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40192",
"url": "https://access.redhat.com/security/cve/CVE-2026-40192"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40895",
"url": "https://access.redhat.com/security/cve/CVE-2026-40895"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42033",
"url": "https://access.redhat.com/security/cve/CVE-2026-42033"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42035",
"url": "https://access.redhat.com/security/cve/CVE-2026-42035"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42039",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42041",
"url": "https://access.redhat.com/security/cve/CVE-2026-42041"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42043",
"url": "https://access.redhat.com/security/cve/CVE-2026-42043"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42044",
"url": "https://access.redhat.com/security/cve/CVE-2026-42044"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4427",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24853.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.15.5",
"tracking": {
"current_release_date": "2026-07-02T22:08:09+00:00",
"generator": {
"date": "2026-07-02T22:08:09+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:24853",
"initial_release_date": "2026-06-09T15:31:40+00:00",
"revision_history": [
{
"date": "2026-06-09T15:31:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-09T15:31:49+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T22:08:09+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.15",
"product": {
"name": "Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.15::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1780891395"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1780584268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Ad3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1780584376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1780584626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1780584775"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1780584287"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1780585491"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ab1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1780584268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3Adb0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1780585598"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1780584376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3Af32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1780590413"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3Aef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1780584626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1780584775"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3A955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1780894591"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1780584287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aafeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1780891395"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ae76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1780584268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1780584376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1780584626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1780584775"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1780584287"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1780891395"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-2377",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-02-11T21:02:44.495000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2439201"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an arbitrary callback URL. A backend process then makes server-side HTTP requests to this provided URL. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow an attacker to send requests from the application\u0027s internal network, potentially leading to the disclosure of sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Due to the intended and supported use case of Openshift Mirror Registry, deployment in an offline or network-isolated environment, the impact for this product has been downgraded to `Moderate`.\n\nEven in case of compromise, the blast radius is restricted to mirror-registry. It can not be escalated outside the core product. This vulnerability has been scored based on the lack of change of scope.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2377"
},
{
"category": "external",
"summary": "RHBZ#2439201",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439201"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2377"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2377",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2377"
}
],
"release_date": "2026-04-08T16:18:10.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: quay: Server-Side Request Forgery via log export functionality"
},
{
"cve": "CVE-2026-4427",
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-27962",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-16T18:02:07.041902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448164"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker\u0027s key, allowing them to bypass authentication and gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This critical vulnerability in Authlib\u0027s JWS implementation allows unauthenticated attackers to forge JWTs by embedding their own cryptographic key in the token header. Impact is high to confidentiality and integrity as attackers can bypass authentication.\n\nThe impact for Red Hat Quay is rated as low because it imports authlib solely as a JWK parsing utility and performs all JWT signature verification through PyJWT, so the vulnerable jws.deserialize_compact() code path is never called.\n\nRed Hat OpenShift AI is not affected, since authlib is only present as a transitive dependency in the dev dependency group and is not included in production image builds, so the vulnerable code is not present in the shipped product.\n\nRed Hat Satellite is not affected, as authlib is only present as a dependency of fastmcp. In Satellite, fastmcp only invokes authlib using jwt.decode() which isn\u0027t able to reach the vulnerability condition even with key=none.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "RHBZ#2448164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27962"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681",
"url": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.6.9",
"url": "https://github.com/authlib/authlib/releases/tag/v1.6.9"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5"
}
],
"release_date": "2026-03-16T17:34:38.946000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32286",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:59.226117+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a \"slice bounds out of range panic\", resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The PostgreSQL server multicluster-globalhub-manager connects to is either provisioned by the operator itself or specified by the admin managing the deployment. To successfully exploit the vulnerability in this context the attacker would need to compromise the operator-deployed PostgreSQL server to force a crafted malicious DataRow message or they would need to have the privileges required to modify the operator-provisioned deployment or configure globalhub-manager to use a compromised/malicious \u201cBYO Postgres\u201d server.\n\nThe first scenario (compromising a legitimate PostgreSQL server) would change Attack Complexity from Low to High resulting in an adjusted CVSS v3.1 score of 5.9 (Moderate)\nThe other scenarios (manipulating the operator provisioned-deployment or configuring the globalhub-manager to use a malicious server) would maintain AC:L but would require privileged access. This would change Privileges Required from None to High resulting in an adjusted CVSS v3.1 score of 4.9 (Moderate)\n\nBased on the above the Impact Rating for multicluster-globalhub-manager-rhel9 is Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "RHBZ#2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4518",
"url": "https://pkg.go.dev/vuln/GO-2026-4518"
}
],
"release_date": "2026-03-26T19:40:51.974000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32589",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2026-03-12T14:43:07.878000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446963"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s container image upload process. An authenticated user with push access to any repository on the registry can interfere with image uploads in progress by other users, including those in repositories they do not have access to. This could allow the attacker to read, modify, or cancel another user\u0027s in-progress image upload.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: insecure direct object reference in BlobUpload",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires valid login credentials to the Quay registry. Unauthenticated users cannot exploit this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32589"
},
{
"category": "external",
"summary": "RHBZ#2446963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446963"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32589"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32589",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32589"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: insecure direct object reference in BlobUpload"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32590",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-03-12T14:43:11.443000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: remote code execution using pickle deserialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires valid login credentials. The attacker must be authenticated to the registry, either through the web interface or through a container tool such as Podman.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "RHBZ#2446964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "mirror-registry: remote code execution using pickle deserialization"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33894",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-27T21:02:52.462999+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Forge (also called `node-forge`), a JavaScript implementation of Transport Layer Security. A remote attacker could exploit weaknesses in the RSASSA PKCS#1 v1.5 signature verification process. By crafting malicious signatures that include extra data within the ASN structure and do not meet padding requirements, an attacker can bypass signature validation. This allows for the creation of forged signatures that appear legitimate, potentially compromising the integrity and authenticity of communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33894"
},
{
"category": "external",
"summary": "RHBZ#2452464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33894"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33894",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33894"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc2313#section-8",
"url": "https://datatracker.ietf.org/doc/html/rfc2313#section-8"
},
{
"category": "external",
"summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp",
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp"
},
{
"category": "external",
"summary": "https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE",
"url": "https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc8017.html",
"url": "https://www.rfc-editor.org/rfc/rfc8017.html"
}
],
"release_date": "2026-03-27T20:45:49.583000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-39892",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-08T22:00:59.416053+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456735"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In default configurations Red Hat products isolate service processes from total system access. Should an attacker be able to exploit this vulnerability their impact will be limited to that service account and they will not have access to the broader system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39892"
},
{
"category": "external",
"summary": "RHBZ#2456735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456735"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39892"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/08/12",
"url": "http://www.openwall.com/lists/oss-security/2026/04/08/12"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5",
"url": "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq",
"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq"
}
],
"release_date": "2026-04-08T20:49:41.967000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API"
},
{
"cve": "CVE-2026-40192",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-04-16T00:00:49.590876+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458856"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service (DoS) by providing a specially crafted FITS image file. The library\u0027s failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory consumption, causing the system to crash or experience severe performance issues.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40192"
},
{
"category": "external",
"summary": "RHBZ#2458856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40192"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628",
"url": "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/pull/9521",
"url": "https://github.com/python-pillow/Pillow/pull/9521"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"
},
{
"category": "external",
"summary": "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"
}
],
"release_date": "2026-04-15T22:53:56.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing"
},
{
"cve": "CVE-2026-40895",
"cwe": {
"id": "CWE-212",
"name": "Improper Removal of Sensitive Information Before Storage or Transfer"
},
"discovery_date": "2026-04-21T21:02:33.280553+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460297"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40895"
},
{
"category": "external",
"summary": "RHBZ#2460297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460297"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40895"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895"
},
{
"category": "external",
"summary": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653",
"url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653"
}
],
"release_date": "2026-04-21T19:59:59.759000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects"
},
{
"cve": "CVE-2026-42033",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T18:01:20.937507+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461607"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42033"
},
{
"category": "external",
"summary": "RHBZ#2461607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42033",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42033"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf"
}
],
"release_date": "2026-04-24T17:36:44.132000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution"
},
{
"cve": "CVE-2026-42035",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T18:01:17.109481+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461606"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application\u0027s core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42035"
},
{
"category": "external",
"summary": "RHBZ#2461606",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461606"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42035"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"
}
],
"release_date": "2026-04-24T17:38:07.752000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "axios: Axios: Arbitrary HTTP header injection via prototype pollution"
},
{
"cve": "CVE-2026-42039",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T19:01:44.887156+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "RHBZ#2461630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
}
],
"release_date": "2026-04-24T18:01:30.775000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data"
},
{
"cve": "CVE-2026-42041",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T19:01:41.034289+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461629"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42041"
},
{
"category": "external",
"summary": "RHBZ#2461629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461629"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42041",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42041"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63",
"url": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63"
}
],
"release_date": "2026-04-24T17:55:30.036000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling"
},
{
"cve": "CVE-2026-42043",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-04-24T19:01:22.552379+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: NO_PROXY bypass via crafted URL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42043"
},
{
"category": "external",
"summary": "RHBZ#2461626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42043"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"
}
],
"release_date": "2026-04-24T17:54:42.668000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: NO_PROXY bypass via crafted URL"
},
{
"cve": "CVE-2026-42044",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T19:01:13.418725+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461624"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution \"Gadget\" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42044"
},
{
"category": "external",
"summary": "RHBZ#2461624",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461624"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42044"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23"
}
],
"release_date": "2026-04-24T17:49:49.517000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-09T15:31:40+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:112909f56592b6d280a68b8104fe0c6f771c7c0156197950fcd1fcccae3c7fbf_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:6ebb0d29e5d4aeb1ec3c16f8478cd1d615d3b42275dd82a20ff966887d603bd6_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:80e7c357130e8a1a2db38713055d9a3e04812d5dd496d937d0d51b5c27f97da5_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:db0def651635715bc2406aef174f500cdc35d52cd693785629c149d0269b5f33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2bab9301dc7f0adb24d243b7c0bb26733751f4bf2c84edbf464ac8dd2753bfa0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:904a679c9230596aea5aab19cb6ecd16d6f7c7e6cca06aca63498ff4896733ba_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:d3d569cf1570a9a0edd4070660ceff622429c98345c369af0ace3458e0ba2308_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f32c7fd3bde4d324f96251826f85aac887aaa44a526eb2e8549a00c6a71abcd0_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:93d75149f451f380dbc59b4f093e0bf8f3ab05044e584f9a229c46abd572cf94_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:9dd5bc1416811a51cc056720e65035c713f335f43d8209bfad4d8d983b36ac72_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:ef0552c8953fc5958bb4bb548820802cc30f0aa8366c0e369a0d30e1f5ddad9b_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:3deb2d564ed7e8ce85861e81681211d84a9c147bb5807c642fe788980aba3038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:82e7c7f7d3a44f312428d1fa7b0c1c6fc644fbf20e9370b2d5803f6687a189a5_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:b1a0cc358536e22f07c9672957484afebf230145a5c85fa4f8acd11349adb219_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:e76e3b94c8aae99addf53b09f15f8f9d52003bfdb9213c93b67b58e71fcd192a_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:955f6c83ce8e6cdd075ef5c7396a8b19f9b8021cc5fb1b909a1dda05f0e3f13f_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7be53b8c4851f7ca174c32556cdc2be807cabfb778ced23054b12288cc7ebbee_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:9abfc7d4e96a46868548380c7db2f11a7ec406c809fb8eee9a7bc3a049adcbbe_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:ec4e8658a1c3f00bd08e8b009cd042bc59a3d870cd17a7db940f1e12d4c05746_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:5b1b98cd31ba150aecd6ef44c2bd8d79ae64380c8e974a4c8c1bb66fb4a38ce9_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:88ca55bb3177d8111971f1ba134bec7967289bfae64ecdf0b751dba0df82d9f0_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:afeeca0c1a653b5c375af4cca8dac1f52db846013d8b50e914ed62e1b7b1aa62_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget"
}
]
}
RHSA-2026:25043
Vulnerability from csaf_redhat - Published: 2026-06-18 16:16 - Updated: 2026-07-02 19:29The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.aarch64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.ppc64le | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.s390x | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.src | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.s390x | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.src | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64 | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x | — |
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64 | — |
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.16.64 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container\nPlatform 4.16.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the RPM packages for Red Hat OpenShift Container\nPlatform 4.16.64. See the following advisory for the container images for\nthis release:\n\nhttps://access.redhat.com/errata/RHSA-2026:25045\n\nSecurity Fix(es):\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url\n(CVE-2026-25679)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:25043",
"url": "https://access.redhat.com/errata/RHSA-2026:25043"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25043.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.16.64 packages and security update",
"tracking": {
"current_release_date": "2026-07-02T19:29:59+00:00",
"generator": {
"date": "2026-07-02T19:29:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:25043",
"initial_release_date": "2026-06-18T16:16:02+00:00",
"revision_history": [
{
"date": "2026-06-18T16:16:02+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-18T16:16:02+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-02T19:29:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.16",
"product": {
"name": "Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.16::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.16",
"product": {
"name": "Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.16::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src",
"product": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src",
"product_id": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-aws-ecr-image-credential-provider@4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src",
"product": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src",
"product_id": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-azure-acr-image-credential-provider@4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src",
"product": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src",
"product_id": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-gcp-gcr-image-credential-provider@4.16.0-202606031028.p2.g26b43df.assembly.stream.el8?arch=src"
}
}
},
{
"category": "product_version",
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src",
"product": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src",
"product_id": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-aws-ecr-image-credential-provider@4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9?arch=src"
}
}
},
{
"category": "product_version",
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src",
"product": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src",
"product_id": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-azure-acr-image-credential-provider@4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9?arch=src"
}
}
},
{
"category": "product_version",
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src",
"product": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src",
"product_id": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-gcp-gcr-image-credential-provider@4.16.0-202606031028.p2.g26b43df.assembly.stream.el9?arch=src"
}
}
},
{
"category": "product_version",
"name": "runc-4:1.2.9-4.rhaos4.16.el9.src",
"product": {
"name": "runc-4:1.2.9-4.rhaos4.16.el9.src",
"product_id": "runc-4:1.2.9-4.rhaos4.16.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc@1.2.9-4.rhaos4.16.el9?arch=src\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.src",
"product": {
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.src",
"product_id": "skopeo-2:1.14.5-7.rhaos4.16.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo@1.14.5-7.rhaos4.16.el9?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64",
"product": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64",
"product_id": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-aws-ecr-image-credential-provider@4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64",
"product": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64",
"product_id": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-azure-acr-image-credential-provider@4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64",
"product": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64",
"product_id": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-gcp-gcr-image-credential-provider@4.16.0-202606031028.p2.g26b43df.assembly.stream.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64",
"product": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64",
"product_id": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-aws-ecr-image-credential-provider@4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64",
"product": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64",
"product_id": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-azure-acr-image-credential-provider@4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64",
"product": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64",
"product_id": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-gcp-gcr-image-credential-provider@4.16.0-202606031028.p2.g26b43df.assembly.stream.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "runc-4:1.2.9-4.rhaos4.16.el9.x86_64",
"product": {
"name": "runc-4:1.2.9-4.rhaos4.16.el9.x86_64",
"product_id": "runc-4:1.2.9-4.rhaos4.16.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc@1.2.9-4.rhaos4.16.el9?arch=x86_64\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64",
"product": {
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64",
"product_id": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc-debugsource@1.2.9-4.rhaos4.16.el9?arch=x86_64\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64",
"product": {
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64",
"product_id": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc-debuginfo@1.2.9-4.rhaos4.16.el9?arch=x86_64\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product": {
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product_id": "skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo@1.14.5-7.rhaos4.16.el9?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product": {
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product_id": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-tests@1.14.5-7.rhaos4.16.el9?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product": {
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product_id": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-debugsource@1.14.5-7.rhaos4.16.el9?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product": {
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product_id": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-debuginfo@1.14.5-7.rhaos4.16.el9?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64",
"product": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64",
"product_id": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-aws-ecr-image-credential-provider@4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64",
"product": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64",
"product_id": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-azure-acr-image-credential-provider@4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64",
"product": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64",
"product_id": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-aws-ecr-image-credential-provider@4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64",
"product": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64",
"product_id": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-azure-acr-image-credential-provider@4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "runc-4:1.2.9-4.rhaos4.16.el9.aarch64",
"product": {
"name": "runc-4:1.2.9-4.rhaos4.16.el9.aarch64",
"product_id": "runc-4:1.2.9-4.rhaos4.16.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc@1.2.9-4.rhaos4.16.el9?arch=aarch64\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64",
"product": {
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64",
"product_id": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc-debugsource@1.2.9-4.rhaos4.16.el9?arch=aarch64\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64",
"product": {
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64",
"product_id": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc-debuginfo@1.2.9-4.rhaos4.16.el9?arch=aarch64\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product": {
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product_id": "skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo@1.14.5-7.rhaos4.16.el9?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product": {
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product_id": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-tests@1.14.5-7.rhaos4.16.el9?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product": {
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product_id": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-debugsource@1.14.5-7.rhaos4.16.el9?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product": {
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product_id": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-debuginfo@1.14.5-7.rhaos4.16.el9?arch=aarch64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le",
"product": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le",
"product_id": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-aws-ecr-image-credential-provider@4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le",
"product": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le",
"product_id": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-azure-acr-image-credential-provider@4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le",
"product": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le",
"product_id": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-gcp-gcr-image-credential-provider@4.16.0-202606031028.p2.g26b43df.assembly.stream.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le",
"product": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le",
"product_id": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-aws-ecr-image-credential-provider@4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le",
"product": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le",
"product_id": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-azure-acr-image-credential-provider@4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le",
"product": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le",
"product_id": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-gcp-gcr-image-credential-provider@4.16.0-202606031028.p2.g26b43df.assembly.stream.el9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "runc-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"product": {
"name": "runc-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"product_id": "runc-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc@1.2.9-4.rhaos4.16.el9?arch=ppc64le\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"product": {
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"product_id": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc-debugsource@1.2.9-4.rhaos4.16.el9?arch=ppc64le\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"product": {
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"product_id": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc-debuginfo@1.2.9-4.rhaos4.16.el9?arch=ppc64le\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product": {
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product_id": "skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo@1.14.5-7.rhaos4.16.el9?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product": {
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product_id": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-tests@1.14.5-7.rhaos4.16.el9?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product": {
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product_id": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-debugsource@1.14.5-7.rhaos4.16.el9?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product": {
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product_id": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-debuginfo@1.14.5-7.rhaos4.16.el9?arch=ppc64le\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x",
"product": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x",
"product_id": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-aws-ecr-image-credential-provider@4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x",
"product": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x",
"product_id": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-azure-acr-image-credential-provider@4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x",
"product": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x",
"product_id": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-gcp-gcr-image-credential-provider@4.16.0-202606031028.p2.g26b43df.assembly.stream.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x",
"product": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x",
"product_id": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-aws-ecr-image-credential-provider@4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x",
"product": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x",
"product_id": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-azure-acr-image-credential-provider@4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x",
"product": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x",
"product_id": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ose-gcp-gcr-image-credential-provider@4.16.0-202606031028.p2.g26b43df.assembly.stream.el9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "runc-4:1.2.9-4.rhaos4.16.el9.s390x",
"product": {
"name": "runc-4:1.2.9-4.rhaos4.16.el9.s390x",
"product_id": "runc-4:1.2.9-4.rhaos4.16.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc@1.2.9-4.rhaos4.16.el9?arch=s390x\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x",
"product": {
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x",
"product_id": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc-debugsource@1.2.9-4.rhaos4.16.el9?arch=s390x\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x",
"product": {
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x",
"product_id": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/runc-debuginfo@1.2.9-4.rhaos4.16.el9?arch=s390x\u0026epoch=4"
}
}
},
{
"category": "product_version",
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.s390x",
"product": {
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.s390x",
"product_id": "skopeo-2:1.14.5-7.rhaos4.16.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo@1.14.5-7.rhaos4.16.el9?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x",
"product": {
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x",
"product_id": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-tests@1.14.5-7.rhaos4.16.el9?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x",
"product": {
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x",
"product_id": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-debugsource@1.14.5-7.rhaos4.16.el9?arch=s390x\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x",
"product": {
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x",
"product_id": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo-debuginfo@1.14.5-7.rhaos4.16.el9?arch=s390x\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64"
},
"product_reference": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le"
},
"product_reference": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x"
},
"product_reference": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src"
},
"product_reference": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64"
},
"product_reference": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64"
},
"product_reference": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le"
},
"product_reference": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x"
},
"product_reference": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src"
},
"product_reference": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64"
},
"product_reference": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le"
},
"product_reference": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x"
},
"product_reference": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src"
},
"product_reference": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64"
},
"product_reference": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64",
"relates_to_product_reference": "8Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64"
},
"product_reference": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le"
},
"product_reference": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x"
},
"product_reference": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src"
},
"product_reference": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64"
},
"product_reference": "ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64"
},
"product_reference": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le"
},
"product_reference": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x"
},
"product_reference": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src"
},
"product_reference": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64"
},
"product_reference": "ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le"
},
"product_reference": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x"
},
"product_reference": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src"
},
"product_reference": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64"
},
"product_reference": "ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-4:1.2.9-4.rhaos4.16.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.aarch64"
},
"product_reference": "runc-4:1.2.9-4.rhaos4.16.el9.aarch64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-4:1.2.9-4.rhaos4.16.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.ppc64le"
},
"product_reference": "runc-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-4:1.2.9-4.rhaos4.16.el9.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.s390x"
},
"product_reference": "runc-4:1.2.9-4.rhaos4.16.el9.s390x",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-4:1.2.9-4.rhaos4.16.el9.src as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.src"
},
"product_reference": "runc-4:1.2.9-4.rhaos4.16.el9.src",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-4:1.2.9-4.rhaos4.16.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.x86_64"
},
"product_reference": "runc-4:1.2.9-4.rhaos4.16.el9.x86_64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64"
},
"product_reference": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le"
},
"product_reference": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x"
},
"product_reference": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64"
},
"product_reference": "runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64"
},
"product_reference": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le"
},
"product_reference": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x"
},
"product_reference": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64"
},
"product_reference": "runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64"
},
"product_reference": "skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le"
},
"product_reference": "skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.s390x"
},
"product_reference": "skopeo-2:1.14.5-7.rhaos4.16.el9.s390x",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.src as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.src"
},
"product_reference": "skopeo-2:1.14.5-7.rhaos4.16.el9.src",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64"
},
"product_reference": "skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64"
},
"product_reference": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le"
},
"product_reference": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x"
},
"product_reference": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64"
},
"product_reference": "skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64"
},
"product_reference": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le"
},
"product_reference": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x"
},
"product_reference": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64"
},
"product_reference": "skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64"
},
"product_reference": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le"
},
"product_reference": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x"
},
"product_reference": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x",
"relates_to_product_reference": "9Base-RHOSE-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64 as a component of Red Hat OpenShift Container Platform 4.16",
"product_id": "9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64"
},
"product_reference": "skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64",
"relates_to_product_reference": "9Base-RHOSE-4.16"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.src",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.src",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64"
],
"known_not_affected": [
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.src",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.src",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-18T16:16:02+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/",
"product_ids": [
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25043"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.src",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.src",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.aarch64",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el8.x86_64",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.aarch64",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el8.x86_64",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.ppc64le",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.s390x",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.src",
"8Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el8.x86_64",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.aarch64",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-aws-ecr-image-credential-provider-0:4.16.0-202606031028.p2.ga53e9de.assembly.stream.el9.x86_64",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.aarch64",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-azure-acr-image-credential-provider-0:4.16.0-202606031028.p2.ge5bac33.assembly.stream.el9.x86_64",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.ppc64le",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.s390x",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.src",
"9Base-RHOSE-4.16:ose-gcp-gcr-image-credential-provider-0:4.16.0-202606031028.p2.g26b43df.assembly.stream.el9.x86_64",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.src",
"9Base-RHOSE-4.16:runc-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-debuginfo-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:runc-debugsource-4:1.2.9-4.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.src",
"9Base-RHOSE-4.16:skopeo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-debuginfo-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-debugsource-2:1.14.5-7.rhaos4.16.el9.x86_64",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.aarch64",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.ppc64le",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.s390x",
"9Base-RHOSE-4.16:skopeo-tests-2:1.14.5-7.rhaos4.16.el9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.