Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-27459 (GCVE-0-2026-27459)
Vulnerability from cvelistv5 – Published: 2026-03-17 23:34 – Updated: 2026-08-12 12:04
VLAI
EPSS
VEX
Title
pyOpenSSL DTLS cookie callback buffer overflow
Summary
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-18 19:52 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
24 references
Impacted products
38 products
| Vendor | Product | Version | |
|---|---|---|---|
| pyca | pyopenssl |
Affected:
>= 22.0.0, < 26.0.0
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
Unaffected:
0:26.0.0-1.el8ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
Unaffected:
0:26.0.0-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:4.7.11-2.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:26.0.0-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 |
Unaffected:
0:24.1.0-2.el8pc , < *
(rpm)
cpe:/a:redhat:satellite:6.16::el8 cpe:/a:redhat:satellite_capsule:6.16::el8 |
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 |
Unaffected:
0:24.1.0-2.el9pc , < *
(rpm)
cpe:/a:redhat:satellite:6.16::el9 cpe:/a:redhat:satellite_capsule:6.16::el9 |
|
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 |
Unaffected:
0:25.1.0-0.3.el9pc , < *
(rpm)
cpe:/a:redhat:satellite:6.17::el9 cpe:/a:redhat:satellite_capsule:6.17::el9 |
|
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 |
Unaffected:
0:26.0.0-2.el9pc , < *
(rpm)
cpe:/a:redhat:satellite:6.18::el9 cpe:/a:redhat:satellite_capsule:6.18::el9 |
|
| Red Hat | RHUI 4 for RHEL 8 |
Unaffected:
0:24.1.0-2.el8ui , < *
(rpm)
cpe:/a:redhat:rhui:4::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 |
Unaffected:
1777398315 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 |
Unaffected:
1777403872 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777390240 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777296732 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777391447 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777299023 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777387242 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777390333 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
26.0.0-1.1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Quay 3.10 |
Unaffected:
1776736910 , < *
(rpm)
cpe:/a:redhat:quay:3.10::el8 |
|
| Red Hat | Red Hat Quay 3.12 |
Unaffected:
1776752646 , < *
(rpm)
cpe:/a:redhat:quay:3.12::el8 |
|
| Red Hat | Red Hat Quay 3.14 |
Unaffected:
1779689392 , < *
(rpm)
cpe:/a:redhat:quay:3.14::el8 |
|
| Red Hat | Red Hat Quay 3.15 |
Unaffected:
1780891395 , < *
(rpm)
cpe:/a:redhat:quay:3.15::el8 |
|
| Red Hat | Red Hat Quay 3.16 |
Unaffected:
1779204086 , < *
(rpm)
cpe:/a:redhat:quay:3.16::el9 |
|
| Red Hat | Red Hat Quay 3.17 |
Unaffected:
1779922205 , < *
(rpm)
cpe:/a:redhat:quay:3.17::el9 |
|
| Red Hat | Red Hat Quay 3.18 |
Unaffected:
1784987273 , < *
(rpm)
cpe:/a:redhat:quay:3.18::el9 |
|
| Red Hat | Red Hat Quay 3.9 |
Unaffected:
1776782369 , < *
(rpm)
cpe:/a:redhat:quay:3.9::el8 |
|
| Red Hat | Red Hat Trusted Artifact Signer 1.4 |
Unaffected:
1775815407 , < *
(rpm)
cpe:/a:redhat:trusted_artifact_signer:1.4::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2 |
|
| Red Hat | Red Hat Ansible Automation Platform Ansible Core 2 |
cpe:/a:redhat:ansible_core:2 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4 |
|
| Red Hat | Red Hat OpenStack Platform 17.1 |
cpe:/a:redhat:openstack:17.1 |
|
| Red Hat | Red Hat OpenStack Platform 18.0 |
cpe:/a:redhat:openstack:18.0 |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27459",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-18T19:52:08.536876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-18T19:52:15.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:26.0.0-1.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:26.0.0-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.7.11-2.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:26.0.0-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.16::el8",
"cpe:/a:redhat:satellite_capsule:6.16::el8"
],
"defaultStatus": "affected",
"packageName": "python-pyOpenSSL",
"product": "Red Hat Satellite 6.16 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:24.1.0-2.el8pc",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.16::el9",
"cpe:/a:redhat:satellite_capsule:6.16::el9"
],
"defaultStatus": "affected",
"packageName": "python-pyOpenSSL",
"product": "Red Hat Satellite 6.16 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:24.1.0-2.el9pc",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.17::el9",
"cpe:/a:redhat:satellite_capsule:6.17::el9"
],
"defaultStatus": "affected",
"packageName": "python-pyOpenSSL",
"product": "Red Hat Satellite 6.17 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:25.1.0-0.3.el9pc",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9",
"cpe:/a:redhat:satellite_capsule:6.18::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyOpenSSL",
"product": "Red Hat Satellite 6.18 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:26.0.0-2.el9pc",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhui:4::el8"
],
"defaultStatus": "affected",
"packageName": "python-pyOpenSSL",
"product": "RHUI 4 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:24.1.0-2.el8ui",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-25/ee-supported-rhel8",
"product": "Red Hat Ansible Automation Platform 2.5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777398315",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-25/lightspeed-rhel8",
"product": "Red Hat Ansible Automation Platform 2.5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777403872",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/ansible-dev-tools-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777390240",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/eda-controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777296732",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/ee-supported-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777391447",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/hub-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777299023",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/lightspeed-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777387242",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/platform-resource-runner-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777390333",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "pyopenssl-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.0.0-1.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776736910",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776752646",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.14::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779689392",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780891395",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779204086",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.17::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779922205",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.18::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784987273",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776782369",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhtas/model-transparency-rhel9",
"product": "Red Hat Trusted Artifact Signer 1.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775815407",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/ee-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3.11-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3x-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python-pyOpenSSL",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform/ee-minimal-rhel8",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform/ee-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-tech-preview/ee-minimal-rhel8",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-tech-preview/ee-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-feature-server-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-mlflow-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "unaffected",
"packageName": "pyOpenSSL",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite/iop-advisor-engine-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite/iop-insights-engine-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-17T23:34:28.483Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T12:04:56.059Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"name": "RHBZ#2448503",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27459.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13512"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10754"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14874"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13508"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14873"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14835"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13553"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7224"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11916"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11856"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21017"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22465"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11996"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:13512: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:10754: RHUI 4 for RHEL 8"
},
{
"lang": "en",
"value": "RHSA-2026:14874: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:13508: Red Hat Ansible Automation Platform 2.6 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:14873: Red Hat Satellite 6.17 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:14835: Red Hat Satellite 6.18 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:13553: Red Hat Ansible Automation Platform 2.5"
},
{
"lang": "en",
"value": "RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:7224: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:11916: Red Hat Quay 3.10"
},
{
"lang": "en",
"value": "RHSA-2026:11856: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:21017: Red Hat Quay 3.14"
},
{
"lang": "en",
"value": "RHSA-2026:24853: Red Hat Quay 3.15"
},
{
"lang": "en",
"value": "RHSA-2026:19375: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:22465: Red Hat Quay 3.17"
},
{
"lang": "en",
"value": "RHSA-2026:48085: Red Hat Quay 3.18"
},
{
"lang": "en",
"value": "RHSA-2026:11996: Red Hat Quay 3.9"
},
{
"lang": "en",
"value": "RHSA-2026:8437: Red Hat Trusted Artifact Signer 1.4"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-18T00:01:41.404Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-17T23:34:28.483Z",
"value": "Made public."
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "pyopenssl",
"vendor": "pyca",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 26.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T23:34:28.483Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
},
{
"name": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"name": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
}
],
"source": {
"advisory": "GHSA-5pwr-322w-8jr4",
"discovery": "UNKNOWN"
},
"title": "pyOpenSSL DTLS cookie callback buffer overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27459",
"datePublished": "2026-03-17T23:34:28.483Z",
"dateReserved": "2026-02-19T17:25:31.100Z",
"dateUpdated": "2026-08-12T12:04:56.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-27459",
"date": "2026-08-15",
"epss": "0.00704",
"percentile": "0.50274"
},
"microsoft_vex": {
"current_release_date": "2026-03-21T01:37:02.000Z",
"cve": "CVE-2026-27459",
"id": "msrc_CVE-2026-27459",
"initial_release_date": "2026-03-02T00:00:00.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "pyOpenSSL DTLS cookie callback buffer overflow",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-27459.json",
"version": "2"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-27459\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-18T00:16:19.273\",\"lastModified\":\"2026-08-12T12:18:17.263\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.\"},{\"lang\":\"es\",\"value\":\"pyOpenSSL es un envoltorio de Python para la biblioteca OpenSSL. A partir de la versi\u00f3n 22.0.0 y antes de la versi\u00f3n 26.0.0, si una devoluci\u00f3n de llamada proporcionada por el usuario a set_cookie_generate_callback devolv\u00eda un valor de cookie superior a 256 bytes, pyOpenSSL desbordar\u00eda un b\u00fafer proporcionado por OpenSSL. A partir de la versi\u00f3n 26.0.0, los valores de cookie que son demasiado largos ahora son rechazados.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"pyca\",\"product\":\"pyopenssl\",\"versions\":[{\"version\":\"\u003e= 22.0.0, \u003c 26.0.0\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"0:26.0.0-1.el8ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"],\"versions\":[{\"version\":\"0:26.0.0-1.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-controller\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"0:4.7.11-2.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"0:26.0.0-1.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el8\",\"cpe:/a:redhat:satellite_capsule:6.16::el8\"],\"versions\":[{\"version\":\"0:24.1.0-2.el8pc\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el9\",\"cpe:/a:redhat:satellite_capsule:6.16::el9\"],\"versions\":[{\"version\":\"0:24.1.0-2.el9pc\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.17 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:satellite:6.17::el9\",\"cpe:/a:redhat:satellite_capsule:6.17::el9\"],\"versions\":[{\"version\":\"0:25.1.0-0.3.el9pc\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\",\"cpe:/a:redhat:satellite_capsule:6.18::el9\"],\"versions\":[{\"version\":\"0:26.0.0-2.el9pc\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"RHUI 4 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:rhui:4::el8\"],\"versions\":[{\"version\":\"0:24.1.0-2.el8ui\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-25/ee-supported-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"1777398315\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-25/lightspeed-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"1777403872\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/ansible-dev-tools-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777390240\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/eda-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777296732\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/ee-supported-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777391447\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/hub-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777299023\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/lightspeed-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777387242\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/platform-resource-runner-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777390333\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyopenssl-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"26.0.0-1.1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.10::el8\"],\"versions\":[{\"version\":\"1776736910\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.12::el8\"],\"versions\":[{\"version\":\"1776752646\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.14::el8\"],\"versions\":[{\"version\":\"1779689392\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.15::el8\"],\"versions\":[{\"version\":\"1780891395\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"],\"versions\":[{\"version\":\"1779204086\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.17::el9\"],\"versions\":[{\"version\":\"1779922205\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.18::el9\"],\"versions\":[{\"version\":\"1784987273\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.9::el8\"],\"versions\":[{\"version\":\"1776782369\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhtas/model-transparency-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"],\"versions\":[{\"version\":\"1775815407\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.11-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3x-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform Ansible Core 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/ee-minimal-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform Ansible Core 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform Ansible Core 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-tech-preview/ee-minimal-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform Ansible Core 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-tech-preview/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-feature-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mlflow-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pyOpenSSL\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-advisor-engine-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-insights-engine-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"UNREPORTED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-18T19:52:08.536876Z\",\"id\":\"CVE-2026-27459\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:pyopenssl:pyopenssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"22.0.0\",\"versionEndExcluding\":\"26.0.0\",\"matchCriteriaId\":\"36CBBDFE-83B3-4F32-98E6-49E62AD0BD1B\"}]}]}],\"references\":[{\"url\":\"https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10754\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11856\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11916\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11996\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13508\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13512\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13545\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13553\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14835\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14873\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14874\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19375\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21017\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22465\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24853\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:48085\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7224\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8437\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-27459\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2448503\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27459.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-15T23:38:44+00:00",
"cve": "CVE-2026-27459",
"id": "CVE-2026-27459",
"initial_release_date": "2026-03-17T23:34:28.483000+00:00",
"product_status:fixed": "106",
"product_status:known_affected": "41",
"product_status:known_not_affected": "1487",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "pyOpenSSL: DTLS cookie callback buffer overflow",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27459.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"pyOpenSSL: DTLS cookie callback buffer overflow\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:26.0.0-1.el8ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:26.0.0-1.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.7.11-2.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"automation-controller\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:26.0.0-1.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el8\", \"cpe:/a:redhat:satellite_capsule:6.16::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:24.1.0-2.el8pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el9\", \"cpe:/a:redhat:satellite_capsule:6.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:24.1.0-2.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_capsule:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:25.1.0-0.3.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\", \"cpe:/a:redhat:satellite_capsule:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:26.0.0-2.el9pc\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:4::el8\"], \"vendor\": \"Red Hat\", \"product\": \"RHUI 4 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:24.1.0-2.el8ui\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777398315\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-25/ee-supported-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777403872\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-25/lightspeed-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777390240\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/ansible-dev-tools-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777296732\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/eda-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777391447\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/ee-supported-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777299023\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/hub-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777387242\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/lightspeed-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777390333\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/platform-resource-runner-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.0.0-1.1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"pyopenssl-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776736910\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776752646\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.14::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779689392\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780891395\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779204086\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779922205\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784987273\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776782369\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775815407\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhtas/model-transparency-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/ee-minimal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3.11-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3x-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python-pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform Ansible Core 2\", \"packageName\": \"ansible-automation-platform/ee-minimal-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform Ansible Core 2\", \"packageName\": \"ansible-automation-platform/ee-minimal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform Ansible Core 2\", \"packageName\": \"ansible-automation-platform-tech-preview/ee-minimal-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform Ansible Core 2\", \"packageName\": \"ansible-automation-platform-tech-preview/ee-minimal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-feature-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mlflow-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"pyOpenSSL\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-advisor-engine-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-insights-engine-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-03-18T00:01:41.404Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-03-17T23:34:28.483Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:13512: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10754: RHUI 4 for RHEL 8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14874: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13508: Red Hat Ansible Automation Platform 2.6 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14873: Red Hat Satellite 6.17 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14835: Red Hat Satellite 6.18 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13553: Red Hat Ansible Automation Platform 2.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7224: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11916: Red Hat Quay 3.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11856: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21017: Red Hat Quay 3.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24853: Red Hat Quay 3.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19375: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22465: Red Hat Quay 3.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:48085: Red Hat Quay 3.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11996: Red Hat Quay 3.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8437: Red Hat Trusted Artifact Signer 1.4\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-03-17T23:34:28.483Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-27459\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2448503\", \"name\": \"RHBZ#2448503\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27459.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13512\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10754\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14874\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13508\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14873\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14835\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13553\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13545\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7224\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11916\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11856\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21017\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24853\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19375\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22465\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:48085\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11996\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8437\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-120\", \"description\": \"Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-12T12:04:56.059Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-27459\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-18T19:52:08.536876Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-18T19:52:12.530Z\"}}], \"cna\": {\"title\": \"pyOpenSSL DTLS cookie callback buffer overflow\", \"source\": {\"advisory\": \"GHSA-5pwr-322w-8jr4\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"pyca\", \"product\": \"pyopenssl\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 22.0.0, \u003c 26.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4\", \"name\": \"https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408\", \"name\": \"https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst\", \"name\": \"https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-120\", \"description\": \"CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-17T23:34:28.483Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-27459\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-12T12:04:56.059Z\", \"dateReserved\": \"2026-02-19T17:25:31.100Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-17T23:34:28.483Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:48085
Vulnerability from csaf_redhat - Published: 2026-07-29 17:45 - Updated: 2026-08-16 12:27Summary
Red Hat Security Advisory: Red Hat Quay 3.18.0
Severity
Important
Notes
Topic: Red Hat Quay 3.18.0 is now available with bug fixes and feature enhancements.
Details: Quay 3.18.0
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
No description is available for this CVE.
CWE-129 - Improper Validation of Array IndexAffected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker's key, allowing them to bypass authentication and gain unauthorized access.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Threats
Impact
Low
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Threats
Impact
Moderate
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
5.2 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Threats
Impact
Important
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 | — |
Vendor Fix
fix
|
Known not affected
27 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 | — | ||
| Unresolved product id: Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 | — |
Threats
Impact
Important
References
63 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.18.0 is now available with bug fixes and feature enhancements.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.18.0",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:48085",
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27962",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32590",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32591",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42039",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4427",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48526",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48085.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.18.0",
"tracking": {
"current_release_date": "2026-08-16T12:27:56+00:00",
"generator": {
"date": "2026-08-16T12:27:56+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:48085",
"initial_release_date": "2026-07-29T17:45:57+00:00",
"revision_history": [
{
"date": "2026-07-29T17:45:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-16T12:27:56+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.18",
"product": {
"name": "Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.18::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1784987883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3Ae07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1785239883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3Ada29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3A8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3A030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1785155359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3Af71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3A62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3A71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3Abde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0?arch=arm64\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3Abc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1?arch=arm64\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3Af2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3Af720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3Aef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3Ac5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3A4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel9@sha256%3A4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel9\u0026tag=1784986956"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel9@sha256%3A4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel9\u0026tag=1784987002"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784987354"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel9@sha256%3Afd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel9\u0026tag=1784986989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel9@sha256%3Aa3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel9\u0026tag=1784986949"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel9@sha256%3A7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel9\u0026tag=1784986977"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel9@sha256%3A14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel9\u0026tag=1784987273"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"relates_to_product_reference": "Red Hat Quay 3.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64 as a component of Red Hat Quay 3.18",
"product_id": "Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64",
"relates_to_product_reference": "Red Hat Quay 3.18"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4427",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448626"
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "RHBZ#2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgproto3",
"url": "https://github.com/jackc/pgproto3"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx",
"url": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-27962",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-16T18:02:07.041902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448164"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker\u0027s key, allowing them to bypass authentication and gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This critical vulnerability in Authlib\u0027s JWS implementation allows unauthenticated attackers to forge JWTs by embedding their own cryptographic key in the token header. Impact is high to confidentiality and integrity as attackers can bypass authentication.\n\nThe impact for Red Hat Quay is rated as low because it imports authlib solely as a JWK parsing utility and performs all JWT signature verification through PyJWT, so the vulnerable jws.deserialize_compact() code path is never called.\n\nRed Hat OpenShift AI is not affected, since authlib is only present as a transitive dependency in the dev dependency group and is not included in production image builds, so the vulnerable code is not present in the shipped product.\n\nRed Hat Satellite is not affected, as authlib is only present as a dependency of fastmcp. In Satellite, fastmcp only invokes authlib using jwt.decode() which isn\u0027t able to reach the vulnerability condition even with key=none.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27962"
},
{
"category": "external",
"summary": "RHBZ#2448164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27962"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27962"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681",
"url": "https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.6.9",
"url": "https://github.com/authlib/authlib/releases/tag/v1.6.9"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5"
}
],
"release_date": "2026-03-16T17:34:38.946000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32590",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-03-12T14:43:11.443000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: remote code execution using pickle deserialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires valid login credentials. The attacker must be authenticated to the registry, either through the web interface or through a container tool such as Podman.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32590"
},
{
"category": "external",
"summary": "RHBZ#2446964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32590"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "mirror-registry: remote code execution using pickle deserialization"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32591",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-03-12T15:09:38.210000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446965"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires the attacker to be authenticated as an organization administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "RHBZ#2446965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446965"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32591"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-42039",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T19:01:44.887156+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "RHBZ#2461630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
}
],
"release_date": "2026-04-24T18:01:30.775000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"known_not_affected": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-29T17:45:57+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48085"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:8e4ba7b36bb00f85351969db32a69ad53c0a830bd28e99d52c634957d0116872_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:a3f7e751e73a721c9f5d430695db34ca46220c77e2c4a405f289b69971032768_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:bde2614ef2445a23f8261dd0547d4b8b6dc1729166feb2205013f69e02e8a0f0_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/clair-rhel9@sha256:c5e4e4beecb97e537bfc5c3625ed44700d76e76b4255c42a1a58eba17dad3ec1_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:188197a713a80ad9157543603ab4a9a2dd3b1ac02dc88e09769e02cc03f53226_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:12843e40f6259e2cadb64f523b6a90cfdbae1bc9a7d403febaf4843988e5824e_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:4d11b17e949e0a60d5f1286de138b7f1972bb171339d3a1025a611e34d2e3b97_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:965399c975124f57adaa95dedad69dc5a55ba9a3f0c1149c48a9a1c4a0236d9a_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:f720ee9b9001f3e5247f23bd379cd71dcecb97b1d0ba7408c18e17bd90963dbc_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:0542c1b9d7d04512224735ab114aa5eb032ef8bf1f4d56bb09dd8ec67a563056_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:162d06a526247c2f65c3468aa42734589dedefcd05bccaf49bc94a2df3da3385_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:58b01cbfc532ee3739e53223598d02441259b0552494dd3eda3acdd9daf18681_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:884f75efc59178b36ea2c03bfbe880f32a7ad9470444dffb5bbb43ccdbc46569_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:71d3d0fa46bca36980ca506eae705b120d9530134dc899b33acf0609459a95ab_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:da29edba778acb7f7fd42408d954363657b6ee33b30234c083f266efc47cb726_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:ef959a28d20634cd659dffbb788bfc08b17f22c1f865746e3114d14cffd163b7_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-builder-rhel9@sha256:fd85bcfac47614fe448ba6fd5020cc01900ce1dbdda2b7ebb37c202dc5f272a1_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:6840404e712485db83fbfba9117eae50cf64c2a944eb58130c4455e138fa36ad_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:4f72b7b5cbe21d3a45e6da097e107376e16e1e189936ccb63b01c4070e943ebe_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:62b71ff5b1a1ea65a758f7ad4d2159914370ca98e363c8cadd522dba4228c486_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:e07a70ef05b6d254743e387e391e56942beb34968348277ff1e79c2a56ead6af_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f2be30c6ab2d3f5f0c7efe4fe3b078b4d4312d6f948464c6331f36825fc44a8c_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-bundle@sha256:030ee454a0e8ae48d1c934128f554ff0b83afe1ca1803cdedfc14bb28a62d019_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:4edc046a5e57b80baf5df567f04785799af859b56c187f0614ca1e97fc1490bd_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:7a80ffaa13fdbe5a30f8827b454d5b67814724a473370dc0d9d5192c3801f304_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:bc606a6e09b2f435906e583ab20dacaecee704da54195befd40f9cfa40ab0ff1_arm64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-operator-rhel9@sha256:f71061cdc7d305b4589266f1833b2d0d2108cfb86be27d0fddb19dea8835cfb0_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:14e7fd727c1dc74e19001952176a8354cbc97ec5b4643a4815b6ffbc6d76e224_s390x",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:4207ba218f8ae31531add66d3ef5bf726f0034dfa7abb109d2c1bb1e2ed8b95b_ppc64le",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:6446f4989c8ad3d09abbd7ccf4af8ee341044f833b2d1e8d2c410c899dc1aa80_amd64",
"Red Hat Quay 3.18:registry.redhat.io/quay/quay-rhel9@sha256:9ee2985651443aef099fd421de5e9b7adb550aeafe2479a424864b85e0e50bc1_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
}
]
}
RHSA-2026:48758
Vulnerability from csaf_redhat - Published: 2026-07-30 11:11 - Updated: 2026-08-16 00:18Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Critical
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
jaeger:
* jaeger-2.20.0-0.8.hum1 (aarch64, x86_64)
* jaeger-2.20.0-0.8.hum1.src (src)
Security Fix(es):
jaeger:
* CVE-2026-62995
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE) standards. This vulnerability allows the library to accept JSON Web Tokens (JWTs) that include non-standard trailing padding. An attacker could exploit this to create malleable JWTs, potentially bypassing security mechanisms like token revocation or anti-replay protection. This could lead to unauthorized access or continued use of tokens that should be invalid.
4.3 (Medium)
Affected products
Fixed
3 products
Threats
Impact
Moderate
A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application's JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.
7.4 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.
7.4 (High)
Affected products
Fixed
3 products
Threats
Impact
Critical
A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jaeger-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
65 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\njaeger:\n * jaeger-2.20.0-0.8.hum1 (aarch64, x86_64)\n * jaeger-2.20.0-0.8.hum1.src (src)\n\nSecurity Fix(es):\n\njaeger:\n * CVE-2026-62995",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:48758",
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-62995",
"url": "https://access.redhat.com/security/cve/CVE-2026-62995"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
"url": "https://access.redhat.com/security/cve/CVE-2026-67314"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
"url": "https://access.redhat.com/security/cve/CVE-2026-67313"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67321",
"url": "https://access.redhat.com/security/cve/CVE-2026-67321"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67312",
"url": "https://access.redhat.com/security/cve/CVE-2026-67312"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-67320",
"url": "https://access.redhat.com/security/cve/CVE-2026-67320"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73086",
"url": "https://access.redhat.com/security/cve/CVE-2026-73086"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48758.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-16T00:18:05+00:00",
"generator": {
"date": "2026-08-16T00:18:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:48758",
"initial_release_date": "2026-07-30T11:11:12+00:00",
"revision_history": [
{
"date": "2026-07-30T11:11:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T13:04:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-16T00:18:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "jaeger-main@aarch64",
"product": {
"name": "jaeger-main@aarch64",
"product_id": "jaeger-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "jaeger-main@src",
"product": {
"name": "jaeger-main@src",
"product_id": "jaeger-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jaeger-main@x86_64",
"product": {
"name": "jaeger-main@x86_64",
"product_id": "jaeger-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jaeger-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jaeger-main@aarch64"
},
"product_reference": "jaeger-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jaeger-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jaeger-main@src"
},
"product_reference": "jaeger-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jaeger-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jaeger-main@x86_64"
},
"product_reference": "jaeger-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-62995",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-07-29T19:02:04.532795+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2508524"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE) standards. This vulnerability allows the library to accept JSON Web Tokens (JWTs) that include non-standard trailing padding. An attacker could exploit this to create malleable JWTs, potentially bypassing security mechanisms like token revocation or anti-replay protection. This could lead to unauthorized access or continued use of tokens that should be invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "joserfc: joserfc: JWT Malleability via Non-Standard Padding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: The joserfc Python library, utilized across various Red Hat products, is susceptible to JWT malleability due to its handling of non-standard trailing padding. This flaw could enable an attacker to bypass token revocation or anti-replay mechanisms in applications that depend on the integrity of JWTs processed by vulnerable versions of the library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-62995"
},
{
"category": "external",
"summary": "RHBZ#2508524",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508524"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-62995",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62995"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-62995",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62995"
},
{
"category": "external",
"summary": "https://github.com/authlib/joserfc/security/advisories/GHSA-5jhw-7jv7-qcqq",
"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-5jhw-7jv7-qcqq"
}
],
"release_date": "2026-07-29T18:27:06.518000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "joserfc: joserfc: JWT Malleability via Non-Standard Padding"
},
{
"cve": "CVE-2026-67312",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-08-01T13:02:36.502842+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510007"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application\u0027s JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via uncontrolled recursion in form data processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67312"
},
{
"category": "external",
"summary": "RHBZ#2510007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510007"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67312"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67312",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67312"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson",
"url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson"
}
],
"release_date": "2026-08-01T12:22:18.102000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Denial of Service via uncontrolled recursion in form data processing"
},
{
"cve": "CVE-2026-67313",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-08-01T13:03:08.824485+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67313"
},
{
"category": "external",
"summary": "RHBZ#2510017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3",
"url": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson",
"url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"
}
],
"release_date": "2026-08-01T12:22:16.493000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
},
{
"cve": "CVE-2026-67314",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-08-01T13:03:49.884962+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510030"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67314"
},
{
"category": "external",
"summary": "RHBZ#2510030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
"url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
"url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
}
],
"release_date": "2026-08-01T12:22:16.603000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
},
{
"cve": "CVE-2026-67320",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-08-01T13:01:50.659496+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509993"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67320"
},
{
"category": "external",
"summary": "RHBZ#2509993",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509993"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67320"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc",
"url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter",
"url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"
}
],
"release_date": "2026-08-01T12:22:17.547000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter"
},
{
"cve": "CVE-2026-67321",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-01T13:02:49.231124+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510011"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Denial of Service via object serialization bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-67321"
},
{
"category": "external",
"summary": "RHBZ#2510011",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-67321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67321"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23",
"url": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass",
"url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"
}
],
"release_date": "2026-08-01T12:22:18.177000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Denial of Service via object serialization bypass"
},
{
"cve": "CVE-2026-73086",
"cwe": {
"id": "CWE-1241",
"name": "Use of Predictable Algorithm in Random Number Generator"
},
"discovery_date": "2026-08-11T17:11:45.607696+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nanoid: nanoid: Predictable ID generation due to integer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the nanoid JavaScript library allows a remote attacker to cause predictable ID generation by exploiting an integer overflow in the `nanoid(size)` function. This can lead to the compromise of session tokens, CSRF tokens, and API keys, bypassing security mechanisms. The attack requires specific conditions, contributing to its Important severity rather than Critical.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73086"
},
{
"category": "external",
"summary": "RHBZ#2514175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73086"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
"url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
"url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
"url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/releases/tag/3.3.12",
"url": "https://github.com/ai/nanoid/releases/tag/3.3.12"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/releases/tag/5.1.11",
"url": "https://github.com/ai/nanoid/releases/tag/5.1.11"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
"url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"
}
],
"release_date": "2026-08-11T16:46:23.024000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-30T11:11:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:48758"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jaeger-main@aarch64",
"Red Hat Hardened Images:jaeger-main@src",
"Red Hat Hardened Images:jaeger-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nanoid: nanoid: Predictable ID generation due to integer overflow"
}
]
}
RHSA-2026:7224
Vulnerability from csaf_redhat - Published: 2026-04-09 04:58 - Updated: 2026-08-16 09:03Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in pyOpenSSL. The set_tlsext_servername_callback callback function can be used to implement Server Name Indication (SNI) during the TLS handshake. When the callback raises an unhandled exception, the handshake incorrectly proceeds instead of terminating. This fail-open behavior can allow an attacker to bypass SNI-based security controls and access restricted endpoints.
5.4 (Medium)
Affected products
Threats
Impact
Moderate
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Threats
Impact
Important
References
20 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:7224",
"url": "https://access.redhat.com/errata/RHSA-2026:7224"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27448",
"url": "https://access.redhat.com/security/cve/CVE-2026-27448"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7224.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-08-16T09:03:59+00:00",
"generator": {
"date": "2026-08-16T09:03:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:7224",
"initial_release_date": "2026-04-09T04:58:57+00:00",
"revision_history": [
{
"date": "2026-04-09T04:58:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-16T09:03:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "pyopenssl-main@src",
"product": {
"name": "pyopenssl-main@src",
"product_id": "pyopenssl-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/pyOpenSSL@26.0.0-1.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "pyopenssl-main@noarch",
"product": {
"name": "pyopenssl-main@noarch",
"product_id": "pyopenssl-main@noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/pyOpenSSL-doc@26.0.0-1.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "pyopenssl-main@noarch as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:pyopenssl-main@noarch"
},
"product_reference": "pyopenssl-main@noarch",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "pyopenssl-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:pyopenssl-main@src"
},
"product_reference": "pyopenssl-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"cwe": {
"id": "CWE-636",
"name": "Not Failing Securely (\u0027Failing Open\u0027)"
},
"discovery_date": "2026-03-18T00:02:04.322126+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448508"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_tlsext_servername_callback callback function can be used to implement Server Name Indication (SNI) during the TLS handshake. When the callback raises an unhandled exception, the handshake incorrectly proceeds instead of terminating. This fail-open behavior can allow an attacker to bypass SNI-based security controls and access restricted endpoints.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_tlsext_servername_callback function. For the handshake to proceed incorrectly, the callback must raise an unhandled exception, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "RHBZ#2448508",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448508"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27448"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27448",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27448"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst#L27",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst#L27"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/d41a814759a9fb49584ca8ab3f7295de49a85aa0",
"url": "https://github.com/pyca/pyopenssl/commit/d41a814759a9fb49584ca8ab3f7295de49a85aa0"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-vp96-hxj8-p424",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-vp96-hxj8-p424"
}
],
"release_date": "2026-03-17T23:24:30.661000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T04:58:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7224"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_tlsext_servername_callback function is wrapped in a try/except block. This block should explicitly return a failure code instead of allowing the exception to propagate.",
"product_ids": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback"
},
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-09T04:58:57+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7224"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:pyopenssl-main@noarch",
"Red Hat Hardened Images:pyopenssl-main@src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
}
]
}
RHSA-2026:8437
Vulnerability from csaf_redhat - Published: 2026-04-16 10:43 - Updated: 2026-08-16 13:24Summary
Red Hat Security Advisory: RHTAS 1.4 - GA Release of Model Transparency
Severity
Important
Notes
Topic: The GA release of the RHTAS Model Transparency CLI image.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4
Details: The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
26 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The GA release of the RHTAS Model Transparency CLI image.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"title": "Topic"
},
{
"category": "general",
"text": "The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8437",
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-30922",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8437.json"
}
],
"title": "Red Hat Security Advisory: RHTAS 1.4 - GA Release of Model Transparency",
"tracking": {
"current_release_date": "2026-08-16T13:24:08+00:00",
"generator": {
"date": "2026-08-16T13:24:08+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:8437",
"initial_release_date": "2026-04-16T10:43:56+00:00",
"revision_history": [
{
"date": "2026-04-16T10:43:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-16T13:24:08+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Trusted Artifact Signer 1.4",
"product": {
"name": "Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Trusted Artifact Signer"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"product": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"product_id": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/model-transparency-rhel9@sha256%3A58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1775815407"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"product": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"product_id": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"product_identification_helper": {
"purl": "pkg:oci/model-transparency-rhel9@sha256%3A66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755?arch=arm64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1775815407"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64"
},
"product_reference": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
},
"product_reference": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:43:56+00:00",
"details": "The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor).\n\nFor details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-30922",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-18T04:02:45.401296+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448553"
}
],
"notes": [
{
"category": "description",
"text": "An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "RHBZ#2448553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-30922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0",
"url": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"
}
],
"release_date": "2026-03-18T02:29:45.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:43:56+00:00",
"details": "The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor).\n\nFor details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:43:56+00:00",
"details": "The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor).\n\nFor details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
SUSE-SU-2026:1192-1
Vulnerability from csaf_suse - Published: 2026-04-07 08:39 - Updated: 2026-04-07 08:39Summary
Security update for python-pyOpenSSL
Severity
Important
Notes
Title of the patch: Security update for python-pyOpenSSL
Description of the patch: This update for python-pyOpenSSL fixes the following issues:
- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).
Patchnames: SUSE-2026-1192,SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1192,SUSE-SLE-Module-Python3-15-SP7-2026-1192,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1192,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1192,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1192,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1192,openSUSE-SLE-15.6-2026-1192
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-pyOpenSSL",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-pyOpenSSL fixes the following issues:\n\n- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1192,SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1192,SUSE-SLE-Module-Python3-15-SP7-2026-1192,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1192,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1192,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1192,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1192,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1192,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1192,openSUSE-SLE-15.6-2026-1192",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1192-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1192-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261192-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1192-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045297.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
}
],
"title": "Security update for python-pyOpenSSL",
"tracking": {
"current_release_date": "2026-04-07T08:39:34Z",
"generator": {
"date": "2026-04-07T08:39:34Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1192-1",
"initial_release_date": "2026-04-07T08:39:34Z",
"revision_history": [
{
"date": "2026-04-07T08:39:34Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"product": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"product_id": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Python 3 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Python 3 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Python 3 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-python3:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp6"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Module for Python 3 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Python 3 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
},
"product_reference": "python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-07T08:39:34Z",
"details": "moderate"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch",
"openSUSE Leap 15.6:python311-pyOpenSSL-23.2.0-150400.3.13.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-07T08:39:34Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
}
]
}
SUSE-SU-2026:20930-1
Vulnerability from csaf_suse - Published: 2026-03-25 03:41 - Updated: 2026-03-25 03:41Summary
Security update for python-pyOpenSSL
Severity
Important
Notes
Title of the patch: Security update for python-pyOpenSSL
Description of the patch: This update for python-pyOpenSSL fixes the following issues:
- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).
Patchnames: SUSE-SLES-16.0-439
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-pyOpenSSL",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-pyOpenSSL fixes the following issues:\n\n- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-439",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20930-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:20930-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620930-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:20930-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045222.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
}
],
"title": "Security update for python-pyOpenSSL",
"tracking": {
"current_release_date": "2026-03-25T03:41:42Z",
"generator": {
"date": "2026-03-25T03:41:42Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:20930-1",
"initial_release_date": "2026-03-25T03:41:42Z",
"revision_history": [
{
"date": "2026-03-25T03:41:42Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"product": {
"name": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"product_id": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
},
"product_reference": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
},
"product_reference": "python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-25T03:41:42Z",
"details": "moderate"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:python313-pyOpenSSL-25.0.0-160000.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-03-25T03:41:42Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
}
]
}
SUSE-SU-2026:20954-1
Vulnerability from csaf_suse - Published: 2026-04-01 09:35 - Updated: 2026-04-01 09:35Summary
Security update for python-pyOpenSSL
Severity
Important
Notes
Title of the patch: Security update for python-pyOpenSSL
Description of the patch: This update for python-pyOpenSSL fixes the following issues:
- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).
Patchnames: SUSE-SLE-Micro-6.1-467
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-pyOpenSSL",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-pyOpenSSL fixes the following issues:\n\n- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-467",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20954-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:20954-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620954-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:20954-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045285.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
}
],
"title": "Security update for python-pyOpenSSL",
"tracking": {
"current_release_date": "2026-04-01T09:35:43Z",
"generator": {
"date": "2026-04-01T09:35:43Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:20954-1",
"initial_release_date": "2026-04-01T09:35:43Z",
"revision_history": [
{
"date": "2026-04-01T09:35:43Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch",
"product": {
"name": "python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch",
"product_id": "python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
},
"product_reference": "python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-01T09:35:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:python311-pyOpenSSL-24.0.0-slfo.1.1_2.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-01T09:35:43Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
}
]
}
SUSE-SU-2026:20960-1
Vulnerability from csaf_suse - Published: 2026-04-01 10:05 - Updated: 2026-04-01 10:05Summary
Security update for python-pyOpenSSL
Severity
Important
Notes
Title of the patch: Security update for python-pyOpenSSL
Description of the patch: This update for python-pyOpenSSL fixes the following issues:
- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).
Patchnames: SUSE-SLE-Micro-6.0-649
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-pyOpenSSL",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-pyOpenSSL fixes the following issues:\n\n- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-649",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20960-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:20960-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620960-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:20960-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045279.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
}
],
"title": "Security update for python-pyOpenSSL",
"tracking": {
"current_release_date": "2026-04-01T10:05:58Z",
"generator": {
"date": "2026-04-01T10:05:58Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:20960-1",
"initial_release_date": "2026-04-01T10:05:58Z",
"revision_history": [
{
"date": "2026-04-01T10:05:58Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python311-pyOpenSSL-24.0.0-2.1.noarch",
"product": {
"name": "python311-pyOpenSSL-24.0.0-2.1.noarch",
"product_id": "python311-pyOpenSSL-24.0.0-2.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-pyOpenSSL-24.0.0-2.1.noarch as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
},
"product_reference": "python311-pyOpenSSL-24.0.0-2.1.noarch",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-01T10:05:58Z",
"details": "moderate"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-pyOpenSSL-24.0.0-2.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-01T10:05:58Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
}
]
}
SUSE-SU-2026:21990-1
Vulnerability from csaf_suse - Published: 2026-06-03 12:33 - Updated: 2026-06-03 12:33Summary
Security update 5.0.8 for Multi-Linux Manager Client Tools, Salt Bundle and Salt
Severity
Important
Notes
Title of the patch: Security update 5.0.8 for Multi-Linux Manager Client Tools, Salt Bundle and Salt
Description of the patch: This update fixes the following issues:
golang-github-prometheus-node_exporter:
- Version 1.10.2:
* meminfo: Fix typo in Zswap metric name
- Version 1.10.1:
* filesystem: Fix mount points being collected multiple
times
* filesystem: Refactor mountinfo parsing (bsc#1261810)
* meminfo: Add Zswap/Zswapped metrics
- Version 1.10.0:
* Changes:
+ mdadm: Use sysfs for RAID metrics
+ filesystem: Add erofs in default excluded fs
+ tcpstat: Use std lib binary.NativeEndian
* New Features:
+ pcidevice: Add new collector for PCIe devices
+ AIX: Add more metrics
+ systemd: Add Virtualization metrics
+ swaps: Add new collector
* Enhancements:
+ wifi: Add packet received and transmitted metrics
+ filesystem: Take super options into account for read-only
+ pcidevice: Add additional metrics
+ perf: Add tlb_data metrics
* Bugs fixed:
+ interrupts: Fix OpenBSD interrupt device parsing
+ diskstats: Simplify condition
+ thermal: Sanitize darwin thermal strings
+ filesystem: Fix Darwin collector cgo memory leak
+ cpufreq: Fix: collector enable
+ ethtool: Fix returning 0 for sanitized metrics
+ netdev: Fix Darwin netdev i/o bytes metric
+ systemd: Fix logging race
+ filesystem: Fix duplicate Darwin CGO import
salt:
- Security issues fixed:
- CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service
(bsc#1259554)
- Other updates and bugfixes:
- Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Hardened Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Fixed testsuite failures
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fixed ansible.playbooks extra-vars quoting (bsc#1257831)
- Fixed virtualenv call in test helper to use proper python version
uyuni-tools:
- Version 0.1.39-0:
- mgrpxy ssh tuning should happen before crypto policies (bsc#1254619)
- Fixed default value for helm registry (bsc#1258927).
- Use static supportconfig name to avoid dynamic search
(bsc#1257941)
- Do not nest multiple tarball files and instead collect
all files into one tarball (bsc#1252964)
- Show where final tarball was generated (bsc#1259208)
venv-salt-minion:
- Security issues fixed:
- CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service
(bsc#1259554)
- CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)
- CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)
- Other updates and bugfixes:
- Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Hardened Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Make users with backslash work for `salt-ssh` (bsc#1254629).
- Fixed `ansible.playbooks` `extra-vars` quoting (bsc#1257831),
- Fixed `virtualenv` call in test helper to use proper Python version.
- Fixed the issue preventing SELinux profile to be loaded on SLES 16
deployed using cloud images (bsc#1258957)
Patchnames: SUSE-SLE-Micro-6.0-740
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x | — |
Vendor Fix
|
Threats
Impact
important
References
28 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update 5.0.8 for Multi-Linux Manager Client Tools, Salt Bundle and Salt",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update fixes the following issues:\n\ngolang-github-prometheus-node_exporter:\n\n- Version 1.10.2:\n\n * meminfo: Fix typo in Zswap metric name\n\n- Version 1.10.1:\n\n * filesystem: Fix mount points being collected multiple\n times\n * filesystem: Refactor mountinfo parsing (bsc#1261810)\n * meminfo: Add Zswap/Zswapped metrics\n\n- Version 1.10.0:\n\n * Changes:\n\n + mdadm: Use sysfs for RAID metrics\n + filesystem: Add erofs in default excluded fs\n + tcpstat: Use std lib binary.NativeEndian\n\n * New Features:\n\n + pcidevice: Add new collector for PCIe devices\n + AIX: Add more metrics\n + systemd: Add Virtualization metrics\n + swaps: Add new collector\n\n * Enhancements:\n\n + wifi: Add packet received and transmitted metrics\n + filesystem: Take super options into account for read-only\n + pcidevice: Add additional metrics\n + perf: Add tlb_data metrics\n\n * Bugs fixed:\n\n + interrupts: Fix OpenBSD interrupt device parsing\n + diskstats: Simplify condition\n + thermal: Sanitize darwin thermal strings\n + filesystem: Fix Darwin collector cgo memory leak\n + cpufreq: Fix: collector enable\n + ethtool: Fix returning 0 for sanitized metrics\n + netdev: Fix Darwin netdev i/o bytes metric\n + systemd: Fix logging race\n + filesystem: Fix duplicate Darwin CGO import\n\nsalt:\n\n- Security issues fixed:\n\n - CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service\n (bsc#1259554)\n\n- Other updates and bugfixes:\n\n - Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)\n - Hardened Tornado from invalid HTTP reason phrases\n - Read full URI from ldap pillar config (bsc#1254900)\n - Fixed testsuite failures\n - Make users with backslash working for salt-ssh (bsc#1254629)\n - Fixed ansible.playbooks extra-vars quoting (bsc#1257831)\n - Fixed virtualenv call in test helper to use proper python version\n\nuyuni-tools:\n\n- Version 0.1.39-0:\n\n - mgrpxy ssh tuning should happen before crypto policies (bsc#1254619)\n - Fixed default value for helm registry (bsc#1258927).\n - Use static supportconfig name to avoid dynamic search\n (bsc#1257941)\n - Do not nest multiple tarball files and instead collect\n all files into one tarball (bsc#1252964)\n - Show where final tarball was generated (bsc#1259208)\n\nvenv-salt-minion:\n\n- Security issues fixed:\n\n - CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service\n (bsc#1259554)\n - CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)\n - CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)\n\n- Other updates and bugfixes:\n\n - Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)\n - Hardened Tornado from invalid HTTP reason phrases\n - Read full URI from ldap pillar config (bsc#1254900)\n - Make users with backslash work for `salt-ssh` (bsc#1254629).\n - Fixed `ansible.playbooks` `extra-vars` quoting (bsc#1257831),\n - Fixed `virtualenv` call in test helper to use proper Python version.\n - Fixed the issue preventing SELinux profile to be loaded on SLES 16\n deployed using cloud images (bsc#1258957)\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-740",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21990-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:21990-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621990-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:21990-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047107.html"
},
{
"category": "self",
"summary": "SUSE Bug 1252964",
"url": "https://bugzilla.suse.com/1252964"
},
{
"category": "self",
"summary": "SUSE Bug 1254619",
"url": "https://bugzilla.suse.com/1254619"
},
{
"category": "self",
"summary": "SUSE Bug 1254629",
"url": "https://bugzilla.suse.com/1254629"
},
{
"category": "self",
"summary": "SUSE Bug 1254900",
"url": "https://bugzilla.suse.com/1254900"
},
{
"category": "self",
"summary": "SUSE Bug 1257583",
"url": "https://bugzilla.suse.com/1257583"
},
{
"category": "self",
"summary": "SUSE Bug 1257831",
"url": "https://bugzilla.suse.com/1257831"
},
{
"category": "self",
"summary": "SUSE Bug 1257941",
"url": "https://bugzilla.suse.com/1257941"
},
{
"category": "self",
"summary": "SUSE Bug 1258927",
"url": "https://bugzilla.suse.com/1258927"
},
{
"category": "self",
"summary": "SUSE Bug 1258957",
"url": "https://bugzilla.suse.com/1258957"
},
{
"category": "self",
"summary": "SUSE Bug 1259208",
"url": "https://bugzilla.suse.com/1259208"
},
{
"category": "self",
"summary": "SUSE Bug 1259554",
"url": "https://bugzilla.suse.com/1259554"
},
{
"category": "self",
"summary": "SUSE Bug 1259700",
"url": "https://bugzilla.suse.com/1259700"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE Bug 1261810",
"url": "https://bugzilla.suse.com/1261810"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31958 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31958/"
}
],
"title": "Security update 5.0.8 for Multi-Linux Manager Client Tools, Salt Bundle and Salt",
"tracking": {
"current_release_date": "2026-06-03T12:33:42Z",
"generator": {
"date": "2026-06-03T12:33:42Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:21990-1",
"initial_release_date": "2026-06-03T12:33:42Z",
"revision_history": [
{
"date": "2026-06-03T12:33:42Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python311-salt-3006.0-16.1.aarch64",
"product": {
"name": "python311-salt-3006.0-16.1.aarch64",
"product_id": "python311-salt-3006.0-16.1.aarch64"
}
},
{
"category": "product_version",
"name": "salt-3006.0-16.1.aarch64",
"product": {
"name": "salt-3006.0-16.1.aarch64",
"product_id": "salt-3006.0-16.1.aarch64"
}
},
{
"category": "product_version",
"name": "salt-master-3006.0-16.1.aarch64",
"product": {
"name": "salt-master-3006.0-16.1.aarch64",
"product_id": "salt-master-3006.0-16.1.aarch64"
}
},
{
"category": "product_version",
"name": "salt-minion-3006.0-16.1.aarch64",
"product": {
"name": "salt-minion-3006.0-16.1.aarch64",
"product_id": "salt-minion-3006.0-16.1.aarch64"
}
},
{
"category": "product_version",
"name": "salt-transactional-update-3006.0-16.1.aarch64",
"product": {
"name": "salt-transactional-update-3006.0-16.1.aarch64",
"product_id": "salt-transactional-update-3006.0-16.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "python311-salt-3006.0-16.1.s390x",
"product": {
"name": "python311-salt-3006.0-16.1.s390x",
"product_id": "python311-salt-3006.0-16.1.s390x"
}
},
{
"category": "product_version",
"name": "salt-3006.0-16.1.s390x",
"product": {
"name": "salt-3006.0-16.1.s390x",
"product_id": "salt-3006.0-16.1.s390x"
}
},
{
"category": "product_version",
"name": "salt-master-3006.0-16.1.s390x",
"product": {
"name": "salt-master-3006.0-16.1.s390x",
"product_id": "salt-master-3006.0-16.1.s390x"
}
},
{
"category": "product_version",
"name": "salt-minion-3006.0-16.1.s390x",
"product": {
"name": "salt-minion-3006.0-16.1.s390x",
"product_id": "salt-minion-3006.0-16.1.s390x"
}
},
{
"category": "product_version",
"name": "salt-transactional-update-3006.0-16.1.s390x",
"product": {
"name": "salt-transactional-update-3006.0-16.1.s390x",
"product_id": "salt-transactional-update-3006.0-16.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-salt-3006.0-16.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64"
},
"product_reference": "python311-salt-3006.0-16.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-salt-3006.0-16.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x"
},
"product_reference": "python311-salt-3006.0-16.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-3006.0-16.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64"
},
"product_reference": "salt-3006.0-16.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-3006.0-16.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x"
},
"product_reference": "salt-3006.0-16.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-master-3006.0-16.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64"
},
"product_reference": "salt-master-3006.0-16.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-master-3006.0-16.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x"
},
"product_reference": "salt-master-3006.0-16.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-minion-3006.0-16.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64"
},
"product_reference": "salt-minion-3006.0-16.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-minion-3006.0-16.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x"
},
"product_reference": "salt-minion-3006.0-16.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-transactional-update-3006.0-16.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64"
},
"product_reference": "salt-transactional-update-3006.0-16.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "salt-transactional-update-3006.0-16.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
},
"product_reference": "salt-transactional-update-3006.0-16.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-03T12:33:42Z",
"details": "low"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-03T12:33:42Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
},
{
"cve": "CVE-2026-31958",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31958"
}
],
"notes": [
{
"category": "general",
"text": "Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31958",
"url": "https://www.suse.com/security/cve/CVE-2026-31958"
},
{
"category": "external",
"summary": "SUSE Bug 1259552 for CVE-2026-31958",
"url": "https://bugzilla.suse.com/1259552"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:python311-salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-master-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-minion-3006.0-16.1.s390x",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.aarch64",
"SUSE Linux Micro 6.0:salt-transactional-update-3006.0-16.1.s390x"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-03T12:33:42Z",
"details": "important"
}
],
"title": "CVE-2026-31958"
}
]
}
SUSE-SU-2026:2242-1
Vulnerability from csaf_suse - Published: 2026-06-03 14:05 - Updated: 2026-06-03 14:05Summary
Security update 5.0.8 for Multi-Linux Manager Salt Bundle
Severity
Important
Notes
Title of the patch: Security update 5.0.8 for Multi-Linux Manager Salt Bundle
Description of the patch: This update fixes the following issues:
venv-salt-minion:
- Security issues fixed:
- CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service
(bsc#1259554)
- CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)
- CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)
- Other updates and bugfixes:
- Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Hardened Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Make users with backslash work for `salt-ssh` (bsc#1254629).
- Fixed `ansible.playbooks` `extra-vars` quoting (bsc#1257831),
- Fixed `virtualenv` call in test helper to use proper Python version.
- Fixed the issue preventing SELinux profile to be loaded on SLES 16
deployed using cloud images (bsc#1258957)
Patchnames: SUSE-2026-2242,SUSE-SLE-Manager-Tools-12-2026-2242
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
22 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update 5.0.8 for Multi-Linux Manager Salt Bundle",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update fixes the following issues:\n\nvenv-salt-minion:\n\n- Security issues fixed:\n\n - CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service\n (bsc#1259554)\n - CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)\n - CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)\n\n- Other updates and bugfixes:\n\n - Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)\n - Hardened Tornado from invalid HTTP reason phrases\n - Read full URI from ldap pillar config (bsc#1254900)\n - Make users with backslash work for `salt-ssh` (bsc#1254629).\n - Fixed `ansible.playbooks` `extra-vars` quoting (bsc#1257831),\n - Fixed `virtualenv` call in test helper to use proper Python version.\n - Fixed the issue preventing SELinux profile to be loaded on SLES 16\n deployed using cloud images (bsc#1258957)\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-2242,SUSE-SLE-Manager-Tools-12-2026-2242",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_2242-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:2242-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20262242-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:2242-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047084.html"
},
{
"category": "self",
"summary": "SUSE Bug 1254629",
"url": "https://bugzilla.suse.com/1254629"
},
{
"category": "self",
"summary": "SUSE Bug 1254900",
"url": "https://bugzilla.suse.com/1254900"
},
{
"category": "self",
"summary": "SUSE Bug 1257583",
"url": "https://bugzilla.suse.com/1257583"
},
{
"category": "self",
"summary": "SUSE Bug 1257831",
"url": "https://bugzilla.suse.com/1257831"
},
{
"category": "self",
"summary": "SUSE Bug 1258957",
"url": "https://bugzilla.suse.com/1258957"
},
{
"category": "self",
"summary": "SUSE Bug 1259554",
"url": "https://bugzilla.suse.com/1259554"
},
{
"category": "self",
"summary": "SUSE Bug 1259700",
"url": "https://bugzilla.suse.com/1259700"
},
{
"category": "self",
"summary": "SUSE Bug 1259804",
"url": "https://bugzilla.suse.com/1259804"
},
{
"category": "self",
"summary": "SUSE Bug 1259808",
"url": "https://bugzilla.suse.com/1259808"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27459 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27459/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-31958 page",
"url": "https://www.suse.com/security/cve/CVE-2026-31958/"
}
],
"title": "Security update 5.0.8 for Multi-Linux Manager Salt Bundle",
"tracking": {
"current_release_date": "2026-06-03T14:05:41Z",
"generator": {
"date": "2026-06-03T14:05:41Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:2242-1",
"initial_release_date": "2026-06-03T14:05:41Z",
"revision_history": [
{
"date": "2026-06-03T14:05:41Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libpcre2-16-0-10.34.1-3.3.1.aarch64",
"product": {
"name": "libpcre2-16-0-10.34.1-3.3.1.aarch64",
"product_id": "libpcre2-16-0-10.34.1-3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libpcre2-32-0-10.34.1-3.3.1.aarch64",
"product": {
"name": "libpcre2-32-0-10.34.1-3.3.1.aarch64",
"product_id": "libpcre2-32-0-10.34.1-3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libpcre2-8-0-10.34.1-3.3.1.aarch64",
"product": {
"name": "libpcre2-8-0-10.34.1-3.3.1.aarch64",
"product_id": "libpcre2-8-0-10.34.1-3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libpcre2-posix2-10.34.1-3.3.1.aarch64",
"product": {
"name": "libpcre2-posix2-10.34.1-3.3.1.aarch64",
"product_id": "libpcre2-posix2-10.34.1-3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "pcre2-devel-10.34.1-3.3.1.aarch64",
"product": {
"name": "pcre2-devel-10.34.1-3.3.1.aarch64",
"product_id": "pcre2-devel-10.34.1-3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "pcre2-devel-static-10.34.1-3.3.1.aarch64",
"product": {
"name": "pcre2-devel-static-10.34.1-3.3.1.aarch64",
"product_id": "pcre2-devel-static-10.34.1-3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "pcre2-tools-10.34.1-3.3.1.aarch64",
"product": {
"name": "pcre2-tools-10.34.1-3.3.1.aarch64",
"product_id": "pcre2-tools-10.34.1-3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.aarch64",
"product": {
"name": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.aarch64",
"product_id": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.aarch64",
"product": {
"name": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.aarch64",
"product_id": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.aarch64",
"product": {
"name": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.aarch64",
"product_id": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-libsodium-1.0.21-3.20.1.aarch64",
"product": {
"name": "saltbundle-libsodium-1.0.21-3.20.1.aarch64",
"product_id": "saltbundle-libsodium-1.0.21-3.20.1.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-libsodium-devel-1.0.21-3.20.1.aarch64",
"product": {
"name": "saltbundle-libsodium-devel-1.0.21-3.20.1.aarch64",
"product_id": "saltbundle-libsodium-devel-1.0.21-3.20.1.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-libzmq-4.3.5-3.21.1.aarch64",
"product": {
"name": "saltbundle-libzmq-4.3.5-3.21.1.aarch64",
"product_id": "saltbundle-libzmq-4.3.5-3.21.1.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-openssl-1.0.2.1p-3.3.2.aarch64",
"product": {
"name": "saltbundle-openssl-1.0.2.1p-3.3.2.aarch64",
"product_id": "saltbundle-openssl-1.0.2.1p-3.3.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.aarch64",
"product": {
"name": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.aarch64",
"product_id": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-swig-4.1.1-3.15.1.aarch64",
"product": {
"name": "saltbundle-swig-4.1.1-3.15.1.aarch64",
"product_id": "saltbundle-swig-4.1.1-3.15.1.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-swig-examples-4.1.1-3.15.1.aarch64",
"product": {
"name": "saltbundle-swig-examples-4.1.1-3.15.1.aarch64",
"product_id": "saltbundle-swig-examples-4.1.1-3.15.1.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-zeromq-devel-4.3.5-3.21.1.aarch64",
"product": {
"name": "saltbundle-zeromq-devel-4.3.5-3.21.1.aarch64",
"product_id": "saltbundle-zeromq-devel-4.3.5-3.21.1.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundle-zeromq-tools-4.3.5-3.21.1.aarch64",
"product": {
"name": "saltbundle-zeromq-tools-4.3.5-3.21.1.aarch64",
"product_id": "saltbundle-zeromq-tools-4.3.5-3.21.1.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-3.11.15-3.52.5.aarch64",
"product": {
"name": "saltbundlepy-3.11.15-3.52.5.aarch64",
"product_id": "saltbundlepy-3.11.15-3.52.5.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-base-3.11.15-3.52.4.aarch64",
"product": {
"name": "saltbundlepy-base-3.11.15-3.52.4.aarch64",
"product_id": "saltbundlepy-base-3.11.15-3.52.4.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-curses-3.11.15-3.52.5.aarch64",
"product": {
"name": "saltbundlepy-curses-3.11.15-3.52.5.aarch64",
"product_id": "saltbundlepy-curses-3.11.15-3.52.5.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbm-3.11.15-3.52.5.aarch64",
"product": {
"name": "saltbundlepy-dbm-3.11.15-3.52.5.aarch64",
"product_id": "saltbundlepy-dbm-3.11.15-3.52.5.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.aarch64",
"product": {
"name": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.aarch64",
"product_id": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.aarch64",
"product": {
"name": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.aarch64",
"product_id": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-devel-3.11.15-3.52.4.aarch64",
"product": {
"name": "saltbundlepy-devel-3.11.15-3.52.4.aarch64",
"product_id": "saltbundlepy-devel-3.11.15-3.52.4.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-libs-3.11.15-3.52.4.aarch64",
"product": {
"name": "saltbundlepy-libs-3.11.15-3.52.4.aarch64",
"product_id": "saltbundlepy-libs-3.11.15-3.52.4.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-libvirt-9.2.0.1-3.3.2.aarch64",
"product": {
"name": "saltbundlepy-libvirt-9.2.0.1-3.3.2.aarch64",
"product_id": "saltbundlepy-libvirt-9.2.0.1-3.3.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-lxml-6.0.2-3.33.2.aarch64",
"product": {
"name": "saltbundlepy-lxml-6.0.2-3.33.2.aarch64",
"product_id": "saltbundlepy-lxml-6.0.2-3.33.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-lxml-devel-6.0.2-3.33.2.aarch64",
"product": {
"name": "saltbundlepy-lxml-devel-6.0.2-3.33.2.aarch64",
"product_id": "saltbundlepy-lxml-devel-6.0.2-3.33.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-m2crypto-0.45.1-3.32.2.aarch64",
"product": {
"name": "saltbundlepy-m2crypto-0.45.1-3.32.2.aarch64",
"product_id": "saltbundlepy-m2crypto-0.45.1-3.32.2.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-pynacl-1.5.0-3.20.1.aarch64",
"product": {
"name": "saltbundlepy-pynacl-1.5.0-3.20.1.aarch64",
"product_id": "saltbundlepy-pynacl-1.5.0-3.20.1.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-testsuite-3.11.15-3.52.4.aarch64",
"product": {
"name": "saltbundlepy-testsuite-3.11.15-3.52.4.aarch64",
"product_id": "saltbundlepy-testsuite-3.11.15-3.52.4.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-tools-3.11.15-3.52.4.aarch64",
"product": {
"name": "saltbundlepy-tools-3.11.15-3.52.4.aarch64",
"product_id": "saltbundlepy-tools-3.11.15-3.52.4.aarch64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-tornado-6.3.2-3.24.2.aarch64",
"product": {
"name": "saltbundlepy-tornado-6.3.2-3.24.2.aarch64",
"product_id": "saltbundlepy-tornado-6.3.2-3.24.2.aarch64"
}
},
{
"category": "product_version",
"name": "venv-salt-minion-3006.0-3.95.1.aarch64",
"product": {
"name": "venv-salt-minion-3006.0-3.95.1.aarch64",
"product_id": "venv-salt-minion-3006.0-3.95.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libpcre2-16-0-64bit-10.34.1-3.3.1.aarch64_ilp32",
"product": {
"name": "libpcre2-16-0-64bit-10.34.1-3.3.1.aarch64_ilp32",
"product_id": "libpcre2-16-0-64bit-10.34.1-3.3.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libpcre2-32-0-64bit-10.34.1-3.3.1.aarch64_ilp32",
"product": {
"name": "libpcre2-32-0-64bit-10.34.1-3.3.1.aarch64_ilp32",
"product_id": "libpcre2-32-0-64bit-10.34.1-3.3.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libpcre2-8-0-64bit-10.34.1-3.3.1.aarch64_ilp32",
"product": {
"name": "libpcre2-8-0-64bit-10.34.1-3.3.1.aarch64_ilp32",
"product_id": "libpcre2-8-0-64bit-10.34.1-3.3.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libpcre2-posix2-64bit-10.34.1-3.3.1.aarch64_ilp32",
"product": {
"name": "libpcre2-posix2-64bit-10.34.1-3.3.1.aarch64_ilp32",
"product_id": "libpcre2-posix2-64bit-10.34.1-3.3.1.aarch64_ilp32"
}
}
],
"category": "architecture",
"name": "aarch64_ilp32"
},
{
"branches": [
{
"category": "product_version",
"name": "autoconf-archive-2016.03.20.1-3.3.1.noarch",
"product": {
"name": "autoconf-archive-2016.03.20.1-3.3.1.noarch",
"product_id": "autoconf-archive-2016.03.20.1-3.3.1.noarch"
}
},
{
"category": "product_version",
"name": "pcre2-doc-10.34.1-3.3.1.noarch",
"product": {
"name": "pcre2-doc-10.34.1-3.3.1.noarch",
"product_id": "pcre2-doc-10.34.1-3.3.1.noarch"
}
},
{
"category": "product_version",
"name": "saltbundle-openssl-doc-1.0.2.1p-3.3.2.noarch",
"product": {
"name": "saltbundle-openssl-doc-1.0.2.1p-3.3.2.noarch",
"product_id": "saltbundle-openssl-doc-1.0.2.1p-3.3.2.noarch"
}
},
{
"category": "product_version",
"name": "saltbundle-swig-doc-4.1.1-3.15.1.noarch",
"product": {
"name": "saltbundle-swig-doc-4.1.1-3.15.1.noarch",
"product_id": "saltbundle-swig-doc-4.1.1-3.15.1.noarch"
}
},
{
"category": "product_version",
"name": "saltbundlepy-docker-7.1.0-3.19.4.noarch",
"product": {
"name": "saltbundlepy-docker-7.1.0-3.19.4.noarch",
"product_id": "saltbundlepy-docker-7.1.0-3.19.4.noarch"
}
},
{
"category": "product_version",
"name": "saltbundlepy-lxml-doc-6.0.2-3.33.2.noarch",
"product": {
"name": "saltbundlepy-lxml-doc-6.0.2-3.33.2.noarch",
"product_id": "saltbundlepy-lxml-doc-6.0.2-3.33.2.noarch"
}
},
{
"category": "product_version",
"name": "saltbundlepy-m2crypto-doc-0.45.1-3.32.2.noarch",
"product": {
"name": "saltbundlepy-m2crypto-doc-0.45.1-3.32.2.noarch",
"product_id": "saltbundlepy-m2crypto-doc-0.45.1-3.32.2.noarch"
}
},
{
"category": "product_version",
"name": "saltbundlepy-passlib-1.7.4-3.12.2.noarch",
"product": {
"name": "saltbundlepy-passlib-1.7.4-3.12.2.noarch",
"product_id": "saltbundlepy-passlib-1.7.4-3.12.2.noarch"
}
},
{
"category": "product_version",
"name": "saltbundlepy-pyopenssl-23.2.0-3.21.1.noarch",
"product": {
"name": "saltbundlepy-pyopenssl-23.2.0-3.21.1.noarch",
"product_id": "saltbundlepy-pyopenssl-23.2.0-3.21.1.noarch"
}
},
{
"category": "product_version",
"name": "saltbundlepy-requests-2.33.1-3.20.2.noarch",
"product": {
"name": "saltbundlepy-requests-2.33.1-3.20.2.noarch",
"product_id": "saltbundlepy-requests-2.33.1-3.20.2.noarch"
}
},
{
"category": "product_version",
"name": "saltbundlepy-urllib3-2.0.7-3.21.3.noarch",
"product": {
"name": "saltbundlepy-urllib3-2.0.7-3.21.3.noarch",
"product_id": "saltbundlepy-urllib3-2.0.7-3.21.3.noarch"
}
},
{
"category": "product_version",
"name": "saltbundlepy-wheel-0.45.1-3.11.3.noarch",
"product": {
"name": "saltbundlepy-wheel-0.45.1-3.11.3.noarch",
"product_id": "saltbundlepy-wheel-0.45.1-3.11.3.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "libpcre2-16-0-10.34.1-3.3.1.ppc64le",
"product": {
"name": "libpcre2-16-0-10.34.1-3.3.1.ppc64le",
"product_id": "libpcre2-16-0-10.34.1-3.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libpcre2-32-0-10.34.1-3.3.1.ppc64le",
"product": {
"name": "libpcre2-32-0-10.34.1-3.3.1.ppc64le",
"product_id": "libpcre2-32-0-10.34.1-3.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libpcre2-8-0-10.34.1-3.3.1.ppc64le",
"product": {
"name": "libpcre2-8-0-10.34.1-3.3.1.ppc64le",
"product_id": "libpcre2-8-0-10.34.1-3.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libpcre2-posix2-10.34.1-3.3.1.ppc64le",
"product": {
"name": "libpcre2-posix2-10.34.1-3.3.1.ppc64le",
"product_id": "libpcre2-posix2-10.34.1-3.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "pcre2-devel-10.34.1-3.3.1.ppc64le",
"product": {
"name": "pcre2-devel-10.34.1-3.3.1.ppc64le",
"product_id": "pcre2-devel-10.34.1-3.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "pcre2-devel-static-10.34.1-3.3.1.ppc64le",
"product": {
"name": "pcre2-devel-static-10.34.1-3.3.1.ppc64le",
"product_id": "pcre2-devel-static-10.34.1-3.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "pcre2-tools-10.34.1-3.3.1.ppc64le",
"product": {
"name": "pcre2-tools-10.34.1-3.3.1.ppc64le",
"product_id": "pcre2-tools-10.34.1-3.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.ppc64le",
"product": {
"name": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.ppc64le",
"product_id": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.ppc64le",
"product": {
"name": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.ppc64le",
"product_id": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.ppc64le",
"product": {
"name": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.ppc64le",
"product_id": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-libsodium-1.0.21-3.20.1.ppc64le",
"product": {
"name": "saltbundle-libsodium-1.0.21-3.20.1.ppc64le",
"product_id": "saltbundle-libsodium-1.0.21-3.20.1.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-libsodium-devel-1.0.21-3.20.1.ppc64le",
"product": {
"name": "saltbundle-libsodium-devel-1.0.21-3.20.1.ppc64le",
"product_id": "saltbundle-libsodium-devel-1.0.21-3.20.1.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-libzmq-4.3.5-3.21.1.ppc64le",
"product": {
"name": "saltbundle-libzmq-4.3.5-3.21.1.ppc64le",
"product_id": "saltbundle-libzmq-4.3.5-3.21.1.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-openssl-1.0.2.1p-3.3.2.ppc64le",
"product": {
"name": "saltbundle-openssl-1.0.2.1p-3.3.2.ppc64le",
"product_id": "saltbundle-openssl-1.0.2.1p-3.3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.ppc64le",
"product": {
"name": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.ppc64le",
"product_id": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-swig-4.1.1-3.15.1.ppc64le",
"product": {
"name": "saltbundle-swig-4.1.1-3.15.1.ppc64le",
"product_id": "saltbundle-swig-4.1.1-3.15.1.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-swig-examples-4.1.1-3.15.1.ppc64le",
"product": {
"name": "saltbundle-swig-examples-4.1.1-3.15.1.ppc64le",
"product_id": "saltbundle-swig-examples-4.1.1-3.15.1.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-zeromq-devel-4.3.5-3.21.1.ppc64le",
"product": {
"name": "saltbundle-zeromq-devel-4.3.5-3.21.1.ppc64le",
"product_id": "saltbundle-zeromq-devel-4.3.5-3.21.1.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundle-zeromq-tools-4.3.5-3.21.1.ppc64le",
"product": {
"name": "saltbundle-zeromq-tools-4.3.5-3.21.1.ppc64le",
"product_id": "saltbundle-zeromq-tools-4.3.5-3.21.1.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-3.11.15-3.52.5.ppc64le",
"product": {
"name": "saltbundlepy-3.11.15-3.52.5.ppc64le",
"product_id": "saltbundlepy-3.11.15-3.52.5.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-base-3.11.15-3.52.4.ppc64le",
"product": {
"name": "saltbundlepy-base-3.11.15-3.52.4.ppc64le",
"product_id": "saltbundlepy-base-3.11.15-3.52.4.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-curses-3.11.15-3.52.5.ppc64le",
"product": {
"name": "saltbundlepy-curses-3.11.15-3.52.5.ppc64le",
"product_id": "saltbundlepy-curses-3.11.15-3.52.5.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbm-3.11.15-3.52.5.ppc64le",
"product": {
"name": "saltbundlepy-dbm-3.11.15-3.52.5.ppc64le",
"product_id": "saltbundlepy-dbm-3.11.15-3.52.5.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.ppc64le",
"product": {
"name": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.ppc64le",
"product_id": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.ppc64le",
"product": {
"name": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.ppc64le",
"product_id": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-devel-3.11.15-3.52.4.ppc64le",
"product": {
"name": "saltbundlepy-devel-3.11.15-3.52.4.ppc64le",
"product_id": "saltbundlepy-devel-3.11.15-3.52.4.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-libs-3.11.15-3.52.4.ppc64le",
"product": {
"name": "saltbundlepy-libs-3.11.15-3.52.4.ppc64le",
"product_id": "saltbundlepy-libs-3.11.15-3.52.4.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-libvirt-9.2.0.1-3.3.2.ppc64le",
"product": {
"name": "saltbundlepy-libvirt-9.2.0.1-3.3.2.ppc64le",
"product_id": "saltbundlepy-libvirt-9.2.0.1-3.3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-lxml-6.0.2-3.33.2.ppc64le",
"product": {
"name": "saltbundlepy-lxml-6.0.2-3.33.2.ppc64le",
"product_id": "saltbundlepy-lxml-6.0.2-3.33.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-lxml-devel-6.0.2-3.33.2.ppc64le",
"product": {
"name": "saltbundlepy-lxml-devel-6.0.2-3.33.2.ppc64le",
"product_id": "saltbundlepy-lxml-devel-6.0.2-3.33.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-m2crypto-0.45.1-3.32.2.ppc64le",
"product": {
"name": "saltbundlepy-m2crypto-0.45.1-3.32.2.ppc64le",
"product_id": "saltbundlepy-m2crypto-0.45.1-3.32.2.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-pynacl-1.5.0-3.20.1.ppc64le",
"product": {
"name": "saltbundlepy-pynacl-1.5.0-3.20.1.ppc64le",
"product_id": "saltbundlepy-pynacl-1.5.0-3.20.1.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-testsuite-3.11.15-3.52.4.ppc64le",
"product": {
"name": "saltbundlepy-testsuite-3.11.15-3.52.4.ppc64le",
"product_id": "saltbundlepy-testsuite-3.11.15-3.52.4.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-tools-3.11.15-3.52.4.ppc64le",
"product": {
"name": "saltbundlepy-tools-3.11.15-3.52.4.ppc64le",
"product_id": "saltbundlepy-tools-3.11.15-3.52.4.ppc64le"
}
},
{
"category": "product_version",
"name": "saltbundlepy-tornado-6.3.2-3.24.2.ppc64le",
"product": {
"name": "saltbundlepy-tornado-6.3.2-3.24.2.ppc64le",
"product_id": "saltbundlepy-tornado-6.3.2-3.24.2.ppc64le"
}
},
{
"category": "product_version",
"name": "venv-salt-minion-3006.0-3.95.1.ppc64le",
"product": {
"name": "venv-salt-minion-3006.0-3.95.1.ppc64le",
"product_id": "venv-salt-minion-3006.0-3.95.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libpcre2-16-0-10.34.1-3.3.1.s390x",
"product": {
"name": "libpcre2-16-0-10.34.1-3.3.1.s390x",
"product_id": "libpcre2-16-0-10.34.1-3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libpcre2-32-0-10.34.1-3.3.1.s390x",
"product": {
"name": "libpcre2-32-0-10.34.1-3.3.1.s390x",
"product_id": "libpcre2-32-0-10.34.1-3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libpcre2-8-0-10.34.1-3.3.1.s390x",
"product": {
"name": "libpcre2-8-0-10.34.1-3.3.1.s390x",
"product_id": "libpcre2-8-0-10.34.1-3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libpcre2-posix2-10.34.1-3.3.1.s390x",
"product": {
"name": "libpcre2-posix2-10.34.1-3.3.1.s390x",
"product_id": "libpcre2-posix2-10.34.1-3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "pcre2-devel-10.34.1-3.3.1.s390x",
"product": {
"name": "pcre2-devel-10.34.1-3.3.1.s390x",
"product_id": "pcre2-devel-10.34.1-3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "pcre2-devel-static-10.34.1-3.3.1.s390x",
"product": {
"name": "pcre2-devel-static-10.34.1-3.3.1.s390x",
"product_id": "pcre2-devel-static-10.34.1-3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "pcre2-tools-10.34.1-3.3.1.s390x",
"product": {
"name": "pcre2-tools-10.34.1-3.3.1.s390x",
"product_id": "pcre2-tools-10.34.1-3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.s390x",
"product": {
"name": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.s390x",
"product_id": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.s390x",
"product": {
"name": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.s390x",
"product_id": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.s390x",
"product": {
"name": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.s390x",
"product_id": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-libsodium-1.0.21-3.20.1.s390x",
"product": {
"name": "saltbundle-libsodium-1.0.21-3.20.1.s390x",
"product_id": "saltbundle-libsodium-1.0.21-3.20.1.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-libsodium-devel-1.0.21-3.20.1.s390x",
"product": {
"name": "saltbundle-libsodium-devel-1.0.21-3.20.1.s390x",
"product_id": "saltbundle-libsodium-devel-1.0.21-3.20.1.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-libzmq-4.3.5-3.21.1.s390x",
"product": {
"name": "saltbundle-libzmq-4.3.5-3.21.1.s390x",
"product_id": "saltbundle-libzmq-4.3.5-3.21.1.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-openssl-1.0.2.1p-3.3.2.s390x",
"product": {
"name": "saltbundle-openssl-1.0.2.1p-3.3.2.s390x",
"product_id": "saltbundle-openssl-1.0.2.1p-3.3.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.s390x",
"product": {
"name": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.s390x",
"product_id": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-swig-4.1.1-3.15.1.s390x",
"product": {
"name": "saltbundle-swig-4.1.1-3.15.1.s390x",
"product_id": "saltbundle-swig-4.1.1-3.15.1.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-swig-examples-4.1.1-3.15.1.s390x",
"product": {
"name": "saltbundle-swig-examples-4.1.1-3.15.1.s390x",
"product_id": "saltbundle-swig-examples-4.1.1-3.15.1.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-zeromq-devel-4.3.5-3.21.1.s390x",
"product": {
"name": "saltbundle-zeromq-devel-4.3.5-3.21.1.s390x",
"product_id": "saltbundle-zeromq-devel-4.3.5-3.21.1.s390x"
}
},
{
"category": "product_version",
"name": "saltbundle-zeromq-tools-4.3.5-3.21.1.s390x",
"product": {
"name": "saltbundle-zeromq-tools-4.3.5-3.21.1.s390x",
"product_id": "saltbundle-zeromq-tools-4.3.5-3.21.1.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-3.11.15-3.52.5.s390x",
"product": {
"name": "saltbundlepy-3.11.15-3.52.5.s390x",
"product_id": "saltbundlepy-3.11.15-3.52.5.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-base-3.11.15-3.52.4.s390x",
"product": {
"name": "saltbundlepy-base-3.11.15-3.52.4.s390x",
"product_id": "saltbundlepy-base-3.11.15-3.52.4.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-curses-3.11.15-3.52.5.s390x",
"product": {
"name": "saltbundlepy-curses-3.11.15-3.52.5.s390x",
"product_id": "saltbundlepy-curses-3.11.15-3.52.5.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbm-3.11.15-3.52.5.s390x",
"product": {
"name": "saltbundlepy-dbm-3.11.15-3.52.5.s390x",
"product_id": "saltbundlepy-dbm-3.11.15-3.52.5.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.s390x",
"product": {
"name": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.s390x",
"product_id": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.s390x",
"product": {
"name": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.s390x",
"product_id": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-devel-3.11.15-3.52.4.s390x",
"product": {
"name": "saltbundlepy-devel-3.11.15-3.52.4.s390x",
"product_id": "saltbundlepy-devel-3.11.15-3.52.4.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-libs-3.11.15-3.52.4.s390x",
"product": {
"name": "saltbundlepy-libs-3.11.15-3.52.4.s390x",
"product_id": "saltbundlepy-libs-3.11.15-3.52.4.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-libvirt-9.2.0.1-3.3.2.s390x",
"product": {
"name": "saltbundlepy-libvirt-9.2.0.1-3.3.2.s390x",
"product_id": "saltbundlepy-libvirt-9.2.0.1-3.3.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-lxml-6.0.2-3.33.2.s390x",
"product": {
"name": "saltbundlepy-lxml-6.0.2-3.33.2.s390x",
"product_id": "saltbundlepy-lxml-6.0.2-3.33.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-lxml-devel-6.0.2-3.33.2.s390x",
"product": {
"name": "saltbundlepy-lxml-devel-6.0.2-3.33.2.s390x",
"product_id": "saltbundlepy-lxml-devel-6.0.2-3.33.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-m2crypto-0.45.1-3.32.2.s390x",
"product": {
"name": "saltbundlepy-m2crypto-0.45.1-3.32.2.s390x",
"product_id": "saltbundlepy-m2crypto-0.45.1-3.32.2.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-pynacl-1.5.0-3.20.1.s390x",
"product": {
"name": "saltbundlepy-pynacl-1.5.0-3.20.1.s390x",
"product_id": "saltbundlepy-pynacl-1.5.0-3.20.1.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-testsuite-3.11.15-3.52.4.s390x",
"product": {
"name": "saltbundlepy-testsuite-3.11.15-3.52.4.s390x",
"product_id": "saltbundlepy-testsuite-3.11.15-3.52.4.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-tools-3.11.15-3.52.4.s390x",
"product": {
"name": "saltbundlepy-tools-3.11.15-3.52.4.s390x",
"product_id": "saltbundlepy-tools-3.11.15-3.52.4.s390x"
}
},
{
"category": "product_version",
"name": "saltbundlepy-tornado-6.3.2-3.24.2.s390x",
"product": {
"name": "saltbundlepy-tornado-6.3.2-3.24.2.s390x",
"product_id": "saltbundlepy-tornado-6.3.2-3.24.2.s390x"
}
},
{
"category": "product_version",
"name": "venv-salt-minion-3006.0-3.95.1.s390x",
"product": {
"name": "venv-salt-minion-3006.0-3.95.1.s390x",
"product_id": "venv-salt-minion-3006.0-3.95.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libpcre2-16-0-10.34.1-3.3.1.x86_64",
"product": {
"name": "libpcre2-16-0-10.34.1-3.3.1.x86_64",
"product_id": "libpcre2-16-0-10.34.1-3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libpcre2-32-0-10.34.1-3.3.1.x86_64",
"product": {
"name": "libpcre2-32-0-10.34.1-3.3.1.x86_64",
"product_id": "libpcre2-32-0-10.34.1-3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libpcre2-8-0-10.34.1-3.3.1.x86_64",
"product": {
"name": "libpcre2-8-0-10.34.1-3.3.1.x86_64",
"product_id": "libpcre2-8-0-10.34.1-3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libpcre2-posix2-10.34.1-3.3.1.x86_64",
"product": {
"name": "libpcre2-posix2-10.34.1-3.3.1.x86_64",
"product_id": "libpcre2-posix2-10.34.1-3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "pcre2-devel-10.34.1-3.3.1.x86_64",
"product": {
"name": "pcre2-devel-10.34.1-3.3.1.x86_64",
"product_id": "pcre2-devel-10.34.1-3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "pcre2-devel-static-10.34.1-3.3.1.x86_64",
"product": {
"name": "pcre2-devel-static-10.34.1-3.3.1.x86_64",
"product_id": "pcre2-devel-static-10.34.1-3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "pcre2-tools-10.34.1-3.3.1.x86_64",
"product": {
"name": "pcre2-tools-10.34.1-3.3.1.x86_64",
"product_id": "pcre2-tools-10.34.1-3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.x86_64",
"product": {
"name": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.x86_64",
"product_id": "saltbundle-libopenssl-devel-1.0.2.1p-3.3.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.x86_64",
"product": {
"name": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.x86_64",
"product_id": "saltbundle-libopenssl1_0_0-1.0.2.1p-3.3.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.x86_64",
"product": {
"name": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.x86_64",
"product_id": "saltbundle-libopenssl1_0_0-hmac-1.0.2.1p-3.3.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-libsodium-1.0.21-3.20.1.x86_64",
"product": {
"name": "saltbundle-libsodium-1.0.21-3.20.1.x86_64",
"product_id": "saltbundle-libsodium-1.0.21-3.20.1.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-libsodium-devel-1.0.21-3.20.1.x86_64",
"product": {
"name": "saltbundle-libsodium-devel-1.0.21-3.20.1.x86_64",
"product_id": "saltbundle-libsodium-devel-1.0.21-3.20.1.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-libzmq-4.3.5-3.21.1.x86_64",
"product": {
"name": "saltbundle-libzmq-4.3.5-3.21.1.x86_64",
"product_id": "saltbundle-libzmq-4.3.5-3.21.1.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-openssl-1.0.2.1p-3.3.2.x86_64",
"product": {
"name": "saltbundle-openssl-1.0.2.1p-3.3.2.x86_64",
"product_id": "saltbundle-openssl-1.0.2.1p-3.3.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.x86_64",
"product": {
"name": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.x86_64",
"product_id": "saltbundle-openssl-cavs-1.0.2.1p-3.3.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-swig-4.1.1-3.15.1.x86_64",
"product": {
"name": "saltbundle-swig-4.1.1-3.15.1.x86_64",
"product_id": "saltbundle-swig-4.1.1-3.15.1.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-swig-examples-4.1.1-3.15.1.x86_64",
"product": {
"name": "saltbundle-swig-examples-4.1.1-3.15.1.x86_64",
"product_id": "saltbundle-swig-examples-4.1.1-3.15.1.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-zeromq-devel-4.3.5-3.21.1.x86_64",
"product": {
"name": "saltbundle-zeromq-devel-4.3.5-3.21.1.x86_64",
"product_id": "saltbundle-zeromq-devel-4.3.5-3.21.1.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundle-zeromq-tools-4.3.5-3.21.1.x86_64",
"product": {
"name": "saltbundle-zeromq-tools-4.3.5-3.21.1.x86_64",
"product_id": "saltbundle-zeromq-tools-4.3.5-3.21.1.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-3.11.15-3.52.5.x86_64",
"product": {
"name": "saltbundlepy-3.11.15-3.52.5.x86_64",
"product_id": "saltbundlepy-3.11.15-3.52.5.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-base-3.11.15-3.52.4.x86_64",
"product": {
"name": "saltbundlepy-base-3.11.15-3.52.4.x86_64",
"product_id": "saltbundlepy-base-3.11.15-3.52.4.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-curses-3.11.15-3.52.5.x86_64",
"product": {
"name": "saltbundlepy-curses-3.11.15-3.52.5.x86_64",
"product_id": "saltbundlepy-curses-3.11.15-3.52.5.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbm-3.11.15-3.52.5.x86_64",
"product": {
"name": "saltbundlepy-dbm-3.11.15-3.52.5.x86_64",
"product_id": "saltbundlepy-dbm-3.11.15-3.52.5.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.x86_64",
"product": {
"name": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.x86_64",
"product_id": "saltbundlepy-dbus-python-1.2.18.1-3.3.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.x86_64",
"product": {
"name": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.x86_64",
"product_id": "saltbundlepy-dbus-python-devel-1.2.18.1-3.3.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-devel-3.11.15-3.52.4.x86_64",
"product": {
"name": "saltbundlepy-devel-3.11.15-3.52.4.x86_64",
"product_id": "saltbundlepy-devel-3.11.15-3.52.4.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-libs-3.11.15-3.52.4.x86_64",
"product": {
"name": "saltbundlepy-libs-3.11.15-3.52.4.x86_64",
"product_id": "saltbundlepy-libs-3.11.15-3.52.4.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-libvirt-9.2.0.1-3.3.2.x86_64",
"product": {
"name": "saltbundlepy-libvirt-9.2.0.1-3.3.2.x86_64",
"product_id": "saltbundlepy-libvirt-9.2.0.1-3.3.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-lxml-6.0.2-3.33.2.x86_64",
"product": {
"name": "saltbundlepy-lxml-6.0.2-3.33.2.x86_64",
"product_id": "saltbundlepy-lxml-6.0.2-3.33.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-lxml-devel-6.0.2-3.33.2.x86_64",
"product": {
"name": "saltbundlepy-lxml-devel-6.0.2-3.33.2.x86_64",
"product_id": "saltbundlepy-lxml-devel-6.0.2-3.33.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-m2crypto-0.45.1-3.32.2.x86_64",
"product": {
"name": "saltbundlepy-m2crypto-0.45.1-3.32.2.x86_64",
"product_id": "saltbundlepy-m2crypto-0.45.1-3.32.2.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-pynacl-1.5.0-3.20.1.x86_64",
"product": {
"name": "saltbundlepy-pynacl-1.5.0-3.20.1.x86_64",
"product_id": "saltbundlepy-pynacl-1.5.0-3.20.1.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-testsuite-3.11.15-3.52.4.x86_64",
"product": {
"name": "saltbundlepy-testsuite-3.11.15-3.52.4.x86_64",
"product_id": "saltbundlepy-testsuite-3.11.15-3.52.4.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-tools-3.11.15-3.52.4.x86_64",
"product": {
"name": "saltbundlepy-tools-3.11.15-3.52.4.x86_64",
"product_id": "saltbundlepy-tools-3.11.15-3.52.4.x86_64"
}
},
{
"category": "product_version",
"name": "saltbundlepy-tornado-6.3.2-3.24.2.x86_64",
"product": {
"name": "saltbundlepy-tornado-6.3.2-3.24.2.x86_64",
"product_id": "saltbundlepy-tornado-6.3.2-3.24.2.x86_64"
}
},
{
"category": "product_version",
"name": "venv-salt-minion-3006.0-3.95.1.x86_64",
"product": {
"name": "venv-salt-minion-3006.0-3.95.1.x86_64",
"product_id": "venv-salt-minion-3006.0-3.95.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Manager Client Tools 12",
"product": {
"name": "SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "venv-salt-minion-3006.0-3.95.1.aarch64 as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64"
},
"product_reference": "venv-salt-minion-3006.0-3.95.1.aarch64",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "venv-salt-minion-3006.0-3.95.1.ppc64le as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le"
},
"product_reference": "venv-salt-minion-3006.0-3.95.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "venv-salt-minion-3006.0-3.95.1.s390x as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x"
},
"product_reference": "venv-salt-minion-3006.0-3.95.1.s390x",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "venv-salt-minion-3006.0-3.95.1.x86_64 as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64"
},
"product_reference": "venv-salt-minion-3006.0-3.95.1.x86_64",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27448"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27448",
"url": "https://www.suse.com/security/cve/CVE-2026-27448"
},
{
"category": "external",
"summary": "SUSE Bug 1259804 for CVE-2026-27448",
"url": "https://bugzilla.suse.com/1259804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-03T14:05:41Z",
"details": "low"
}
],
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27459"
}
],
"notes": [
{
"category": "general",
"text": "pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27459",
"url": "https://www.suse.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "SUSE Bug 1259808 for CVE-2026-27459",
"url": "https://bugzilla.suse.com/1259808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-03T14:05:41Z",
"details": "important"
}
],
"title": "CVE-2026-27459"
},
{
"cve": "CVE-2026-31958",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-31958"
}
],
"notes": [
{
"category": "general",
"text": "Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-31958",
"url": "https://www.suse.com/security/cve/CVE-2026-31958"
},
{
"category": "external",
"summary": "SUSE Bug 1259552 for CVE-2026-31958",
"url": "https://bugzilla.suse.com/1259552"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.aarch64",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.ppc64le",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.s390x",
"SUSE Manager Client Tools 12:venv-salt-minion-3006.0-3.95.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-03T14:05:41Z",
"details": "important"
}
],
"title": "CVE-2026-31958"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…