Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-33186 (GCVE-0-2026-33186)
Vulnerability from cvelistv5 – Published: 2026-03-20 22:23 – Updated: 2026-07-03 12:04
VLAI
EPSS
Title
gRPC-Go has an authorization bypass via missing leading slash in :path
Summary
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
166 references
Impacted products
152 products
| Vendor | Product | Version | |
|---|---|---|---|
| grpc | grpc-go |
Affected:
< 1.79.3
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.16 |
cpe:/a:redhat:openshift:4.16::el8 cpe:/a:redhat:openshift:4.16::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.18 |
cpe:/a:redhat:openshift:4.18::el8 cpe:/a:redhat:openshift:4.18::el9 |
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 |
cpe:/a:redhat:satellite:6.16::el8 cpe:/a:redhat:satellite_capsule:6.16::el8 cpe:/a:redhat:satellite_maintenance:6.16::el8 cpe:/a:redhat:satellite_utils:6.16::el8 |
|
| Red Hat | Cryostat 4 on RHEL 9 |
cpe:/a:redhat:cryostat:4::el9 |
|
| Red Hat | Red Hat OpenStack Platform 17.1 |
cpe:/a:redhat:openstack:17.1 cpe:/a:redhat:openstack:17.1::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.19 |
cpe:/a:redhat:openshift:4.19::el9 |
|
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 |
cpe:/a:redhat:satellite:6.16::el9 cpe:/a:redhat:satellite_capsule:6.16::el9 cpe:/a:redhat:satellite_maintenance:6.16::el9 cpe:/a:redhat:satellite_utils:6.16::el9 |
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS (v. 10.0) |
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 10) |
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 8) |
cpe:/a:redhat:enterprise_linux:8::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS (v.9.4) |
cpe:/a:redhat:rhel_eus:9.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS (v.9.6) |
cpe:/a:redhat:rhel_eus:9.6::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 9) |
cpe:/a:redhat:enterprise_linux:9::appstream |
|
| Red Hat | Red Hat CodeReady Linux Builder EUS (v.9.6) |
cpe:/a:redhat:rhel_eus:9.6::crb |
|
| Red Hat | Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) |
cpe:/a:redhat:enterprise_linux:9::crb |
|
| Red Hat | DevWorkspace Operator 0.4 |
cpe:/a:redhat:devworkspace:0.40::el9 |
|
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.4 |
cpe:/a:redhat:logging:6.4::el9 |
|
| Red Hat | Multicluster Global Hub 1.3.4 |
cpe:/a:redhat:multicluster_globalhub:1.3::el9 |
|
| Red Hat | Multicluster Global Hub 1.4.5 |
cpe:/a:redhat:multicluster_globalhub:1.4::el9 |
|
| Red Hat | Multicluster Global Hub 1.5.4 |
cpe:/a:redhat:multicluster_globalhub:1.5::el9 |
|
| Red Hat | Multicluster Global Hub 1.6.2 |
cpe:/a:redhat:multicluster_globalhub:1.6::el9 |
|
| Red Hat | Network Observability (NETOBSERV) 1.11.2 |
cpe:/a:redhat:network_observ_optr:1.11::el9 |
|
| Red Hat | OpenShift API for Data Protection 1.4 |
cpe:/a:redhat:openshift_api_data_protection:1.4::el9 |
|
| Red Hat | OpenShift API for Data Protection 1.5 |
cpe:/a:redhat:openshift_api_data_protection:1.5::el9 |
|
| Red Hat | OpenShift Compliance Operator 1 |
cpe:/a:redhat:openshift_compliance_operator:1::el9 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 |
cpe:/a:redhat:acm:2.13::el9 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 |
cpe:/a:redhat:acm:2.14::el9 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 |
cpe:/a:redhat:acm:2.15::el9 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 |
cpe:/a:redhat:acm:2.16::el9 |
|
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 |
cpe:/a:redhat:advanced_cluster_security:4.10::el8 |
|
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.8 |
cpe:/a:redhat:advanced_cluster_security:4.8::el8 |
|
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.9 |
cpe:/a:redhat:advanced_cluster_security:4.9::el8 |
|
| Red Hat | Red Hat Container Native Virtualization 4.18 |
cpe:/a:redhat:container_native_virtualization:4.18::el9 |
|
| Red Hat | Red Hat Container Native Virtualization 4.19 |
cpe:/a:redhat:container_native_virtualization:4.19::el9 |
|
| Red Hat | Red Hat Container Native Virtualization 4.20 |
cpe:/a:redhat:container_native_virtualization:4.20::el9 |
|
| Red Hat | Red Hat Container Native Virtualization 4.21 |
cpe:/a:redhat:container_native_virtualization:4.21::el9 |
|
| Red Hat | Red Hat Developer Hub 1.8 |
cpe:/a:redhat:rhdh:1.8::el9 |
|
| Red Hat | Red Hat Developer Hub 1.9 |
cpe:/a:redhat:rhdh:1.9::el9 |
|
| Red Hat | Red Hat Lightspeed (formerly Insights) for Runtimes 1 |
cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift Builds 1.6.5 |
cpe:/a:redhat:openshift_builds:1.6::el9 |
|
| Red Hat | Red Hat OpenShift Builds 1.7.3 |
cpe:/a:redhat:openshift_builds:1.7::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.12 |
cpe:/a:redhat:openshift:4.12::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.13 |
cpe:/a:redhat:openshift:4.13::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.14 |
cpe:/a:redhat:openshift:4.14::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.15 |
cpe:/a:redhat:openshift:4.15::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.17 |
cpe:/a:redhat:openshift:4.17::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.20 |
cpe:/a:redhat:openshift:4.20::el9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4.21 |
cpe:/a:redhat:openshift:4.21::el9 |
|
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 |
cpe:/a:redhat:openshift_devspaces:3.27::el9 |
|
| Red Hat | Red Hat OpenShift GitOps 1.18 |
cpe:/a:redhat:openshift_gitops:1.18::el8 |
|
| Red Hat | Red Hat OpenShift GitOps 1.19 |
cpe:/a:redhat:openshift_gitops:1.19::el8 |
|
| Red Hat | Red Hat OpenShift Pipelines 1.21 |
cpe:/a:redhat:openshift_pipelines:1.21::el9 |
|
| Red Hat | Red Hat OpenShift Pipelines 1.2 |
cpe:/a:redhat:openshift_pipelines:1.20::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 2.6 |
cpe:/a:redhat:service_mesh:2.6::el8 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.0 |
cpe:/a:redhat:service_mesh:3.0::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.1 |
cpe:/a:redhat:service_mesh:3.1::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.2 |
cpe:/a:redhat:service_mesh:3.2::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.3 |
cpe:/a:redhat:service_mesh:3.3::el9 |
|
| Red Hat | Red Hat OpenShift distributed tracing 3.9.3 |
cpe:/a:redhat:openshift_distributed_tracing:3.9::el9 |
|
| Red Hat | Red Hat Openshift Data Foundation 4.16 |
cpe:/a:redhat:openshift_data_foundation:4.16::el9 |
|
| Red Hat | Red Hat Openshift Data Foundation 4.18 |
cpe:/a:redhat:openshift_data_foundation:4.18::el9 |
|
| Red Hat | Red Hat Openshift Data Foundation 4.19 |
cpe:/a:redhat:openshift_data_foundation:4.19::el9 |
|
| Red Hat | Red Hat Openshift Data Foundation 4.2 |
cpe:/a:redhat:openshift_data_foundation:4.20::el9 |
|
| Red Hat | Red Hat Quay 3.10 |
cpe:/a:redhat:quay:3.10::el8 |
|
| Red Hat | Red Hat Quay 3.12 |
cpe:/a:redhat:quay:3.12::el8 |
|
| Red Hat | Red Hat Quay 3.14 |
cpe:/a:redhat:quay:3.14::el8 |
|
| Red Hat | Red Hat Quay 3.15 |
cpe:/a:redhat:quay:3.15::el8 |
|
| Red Hat | Red Hat Quay 3.16 |
cpe:/a:redhat:quay:3.16::el9 |
|
| Red Hat | Red Hat Quay 3.17 |
cpe:/a:redhat:quay:3.17::el9 |
|
| Red Hat | Red Hat Quay 3.9 |
cpe:/a:redhat:quay:3.9::el8 |
|
| Red Hat | Red Hat Trusted Artifact Signer 1.3 |
cpe:/a:redhat:trusted_artifact_signer:1.3::el9 |
|
| Red Hat | Red Hat Web Terminal 1.13 |
cpe:/a:redhat:webterminal:1.13::el9 |
|
| Red Hat | Red Hat Web Terminal 1.14 |
cpe:/a:redhat:webterminal:1.14::el9 |
|
| Red Hat | Red Hat Web Terminal 1.15 |
cpe:/a:redhat:webterminal:1.15::el9 |
|
| Red Hat | multicluster engine for Kubernetes 2.10 |
cpe:/a:redhat:multicluster_engine:2.10::el9 |
|
| Red Hat | multicluster engine for Kubernetes 2.11 |
cpe:/a:redhat:multicluster_engine:2.11::el9 |
|
| Red Hat | multicluster engine for Kubernetes 2.6 |
cpe:/a:redhat:multicluster_engine:2.6::el8 |
|
| Red Hat | multicluster engine for Kubernetes 2.8 |
cpe:/a:redhat:multicluster_engine:2.8::el9 |
|
| Red Hat | multicluster engine for Kubernetes 2.9 |
cpe:/a:redhat:multicluster_engine:2.9::el9 |
|
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 |
cpe:/a:redhat:assisted_installer:2 |
|
| Red Hat | cert-manager Operator for Red Hat OpenShift |
cpe:/a:redhat:cert_manager:1 |
|
| Red Hat | Cryostat 4 |
cpe:/a:redhat:cryostat:4 |
|
| Red Hat | Deployment Validation Operator |
cpe:/a:redhat:deployment_validator_operator |
|
| Red Hat | Dynamic Accelerator Slicer Operator for Red Hat OpenShift |
cpe:/a:redhat:dynamic_accelerator_slicer:1 |
|
| Red Hat | ExternalDNS Operator |
cpe:/a:redhat:ext_dns_optr:1 |
|
| Red Hat | File Integrity Operator |
cpe:/a:redhat:openshift_file_integrity_operator:1 |
|
| Red Hat | Gatekeeper 3 |
cpe:/a:redhat:gatekeeper:3 |
|
| Red Hat | Job Set Tech Preview |
cpe:/a:redhat:job_set:0 |
|
| Red Hat | Kernel Module Management Operator for Red Hat Openshift |
cpe:/a:redhat:kernel_module_management:2 |
|
| Red Hat | Kube Descheduler Operator |
cpe:/a:redhat:kube_descheduler_operator:4 |
|
| Red Hat | Leader Worker Set |
cpe:/a:redhat:leader_worker_set:1 |
|
| Red Hat | Logging Subsystem for Red Hat OpenShift |
cpe:/a:redhat:logging:5 |
|
| Red Hat | Logical Volume Manager Storage |
cpe:/a:redhat:lvms:4 |
|
| Red Hat | Migration Toolkit for Containers |
cpe:/a:redhat:rhmt:1 |
|
| Red Hat | Migration Toolkit for Virtualization |
cpe:/a:redhat:migration_toolkit_virtualization:2 |
|
| Red Hat | Multicluster Engine for Kubernetes |
cpe:/a:redhat:multicluster_engine |
|
| Red Hat | Multicluster Global Hub |
cpe:/a:redhat:multicluster_globalhub |
|
| Red Hat | OpenShift API for Data Protection |
cpe:/a:redhat:openshift_api_data_protection:1 |
|
| Red Hat | OpenShift Developer Tools and Services |
cpe:/a:redhat:ocp_tools |
|
| Red Hat | OpenShift Lightspeed |
cpe:/a:redhat:openshift_lightspeed |
|
| Red Hat | OpenShift Pipelines |
cpe:/a:redhat:openshift_pipelines:1 |
|
| Red Hat | OpenShift Run Once Duration Override Operator |
cpe:/a:redhat:run_once_duration_override_operator:1 |
|
| Red Hat | OpenShift Secondary Scheduler Operator |
cpe:/a:redhat:openshift_secondary_scheduler:1 |
|
| Red Hat | OpenShift Serverless |
cpe:/a:redhat:serverless:1 |
|
| Red Hat | OpenShift Service Mesh 2 |
cpe:/a:redhat:service_mesh:2 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 |
cpe:/a:redhat:acm:2 |
|
| Red Hat | Red Hat AI Inference Server |
cpe:/a:redhat:ai_inference_server:3 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2 |
|
| Red Hat | Red Hat Build of Podman Desktop |
cpe:/a:redhat:podman_desktop:1 |
|
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview |
cpe:/a:redhat:podman_desktop:0 |
|
| Red Hat | Red Hat Certification Program for Red Hat Enterprise Linux 9 |
cpe:/a:redhat:certifications:9 |
|
| Red Hat | Red Hat Connectivity Link 1 |
cpe:/a:redhat:connectivity_link:1 |
|
| Red Hat | Red Hat Edge Manager 1 |
cpe:/a:redhat:edge_manager:1 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 |
cpe:/a:redhat:enterprise_linux_ai:3 |
|
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai |
|
| Red Hat | Red Hat OpenShift Cluster Manager CLI |
cpe:/a:redhat:openshift_cluster_manager_cli:1 |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4 |
|
| Red Hat | Red Hat Openshift Data Foundation 4 |
cpe:/a:redhat:openshift_data_foundation:4 |
|
| Red Hat | Red Hat OpenShift GitOps |
cpe:/a:redhat:openshift_gitops:1 |
|
| Red Hat | Red Hat OpenShift Virtualization 4 |
cpe:/a:redhat:container_native_virtualization:4 |
|
| Red Hat | Red Hat OpenStack Platform 16.2 |
cpe:/a:redhat:openstack:16.2 |
|
| Red Hat | Red Hat Quay 3 |
cpe:/a:redhat:quay:3 |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
|
| Red Hat | Red Hat Trusted Artifact Signer |
cpe:/a:redhat:trusted_artifact_signer:1 |
|
| Red Hat | Security Profiles Operator |
cpe:/a:redhat:openshift_security_profiles_operator:1 |
|
| Red Hat | Self Node Remediation Operator |
cpe:/a:redhat:workload_availability_snr:0 |
|
| Red Hat | Storage-Based Remediation |
cpe:/a:redhat:workload_availability_sbr:0 |
|
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview |
cpe:/a:redhat:zero_trust_workload_identity_manager:0 |
|
| Red Hat | Builds for Red Hat OpenShift |
cpe:/a:redhat:openshift_builds:1 |
|
| Red Hat | Confidential Compute Attestation |
cpe:/a:redhat:confidential_compute_attestation:1 |
|
| Red Hat | Custom Metric Autoscaler operator for Red Hat Openshift |
cpe:/a:redhat:openshift_custom_metrics_autoscaler:2 |
|
| Red Hat | External Secrets Operator for Red Hat OpenShift |
cpe:/a:redhat:external_secrets_operator:1 |
|
| Red Hat | Machine Deletion Remediation Operator |
cpe:/a:redhat:workload_availability_mdr:0 |
|
| Red Hat | Migration Toolkit for Applications 8 |
cpe:/a:redhat:migration_toolkit_applications:8 |
|
| Red Hat | OpenShift Service Mesh 3 |
cpe:/a:redhat:service_mesh:3 |
|
| Red Hat | Power monitoring for Red Hat OpenShift |
cpe:/a:redhat:openshift_power_monitoring |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
|
| Red Hat | Red Hat Build of Kueue |
cpe:/a:redhat:kueue_operator:1 |
|
| Red Hat | Red Hat OpenShift Dev Workspaces Operator |
cpe:/a:redhat:devworkspace |
|
| Red Hat | Red Hat OpenShift for Windows Containers |
cpe:/a:redhat:windows_machine_config |
|
| Red Hat | Red Hat OpenStack Platform 18.0 |
cpe:/a:redhat:openstack:18.0 |
|
| Red Hat | Red Hat Service Interconnect 1 |
cpe:/a:redhat:service_interconnect:1 |
|
| Red Hat | Red Hat Trusted Profile Analyzer |
cpe:/a:redhat:trusted_profile_analyzer:2 |
|
| Red Hat | Service Telemetry Framework 1.5 |
cpe:/a:redhat:stf:1.5 |
|
| Red Hat | Zero Trust Workload Identity Manager |
cpe:/a:redhat:zero_trust_workload_identity_manager:1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33186",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T18:08:38.989284Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T18:09:13.422Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:openshift:4.16::el8",
"cpe:/a:redhat:openshift:4.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.16",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.18::el8",
"cpe:/a:redhat:openshift:4.18::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.18",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6.16::el8",
"cpe:/a:redhat:satellite_capsule:6.16::el8",
"cpe:/a:redhat:satellite_maintenance:6.16::el8",
"cpe:/a:redhat:satellite_utils:6.16::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6.16 for RHEL 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openstack:17.1",
"cpe:/a:redhat:openstack:17.1::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6.16::el9",
"cpe:/a:redhat:satellite_capsule:6.16::el9",
"cpe:/a:redhat:satellite_maintenance:6.16::el9",
"cpe:/a:redhat:satellite_utils:6.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6.16 for RHEL 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 10)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 9)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::crb"
],
"defaultStatus": "affected",
"product": "Red Hat CodeReady Linux Builder EUS (v.9.6)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:devworkspace:0.40::el9"
],
"defaultStatus": "affected",
"product": "DevWorkspace Operator 0.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:logging:6.4::el9"
],
"defaultStatus": "affected",
"product": "Logging Subsystem for Red Hat OpenShift 6.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.3::el9"
],
"defaultStatus": "affected",
"product": "Multicluster Global Hub 1.3.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.4::el9"
],
"defaultStatus": "affected",
"product": "Multicluster Global Hub 1.4.5",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.5::el9"
],
"defaultStatus": "affected",
"product": "Multicluster Global Hub 1.5.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.6::el9"
],
"defaultStatus": "affected",
"product": "Multicluster Global Hub 1.6.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:network_observ_optr:1.11::el9"
],
"defaultStatus": "affected",
"product": "Network Observability (NETOBSERV) 1.11.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1.4::el9"
],
"defaultStatus": "affected",
"product": "OpenShift API for Data Protection 1.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1.5::el9"
],
"defaultStatus": "affected",
"product": "OpenShift API for Data Protection 1.5",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_compliance_operator:1::el9"
],
"defaultStatus": "affected",
"product": "OpenShift Compliance Operator 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2.13::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2.14::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2.15::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.10::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.8::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.9::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.18::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Container Native Virtualization 4.18",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.19::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Container Native Virtualization 4.19",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.20::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Container Native Virtualization 4.20",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4.21::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Container Native Virtualization 4.21",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhdh:1.8::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Developer Hub 1.8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhdh:1.9::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Developer Hub 1.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Lightspeed (formerly Insights) for Runtimes 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_builds:1.6::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Builds 1.6.5",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_builds:1.7::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Builds 1.7.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.12::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.12",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.13::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.13",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.14::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.14",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.17",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_gitops:1.18::el8"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift GitOps 1.18",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_gitops:1.19::el8"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift GitOps 1.19",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1.21::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Pipelines 1.21",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1.20::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Pipelines 1.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:2.6::el8"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 2.6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.0::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.1::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.2::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.3::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift distributed tracing 3.9.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Openshift Data Foundation 4.16",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.18::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Openshift Data Foundation 4.18",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.19::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Openshift Data Foundation 4.19",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.20::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Openshift Data Foundation 4.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.14::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.14",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.17::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.17",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Trusted Artifact Signer 1.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:webterminal:1.13::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Web Terminal 1.13",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:webterminal:1.14::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Web Terminal 1.14",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:webterminal:1.15::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Web Terminal 1.15",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.10::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.11::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.11",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.6::el8"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.9::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:assisted_installer:2"
],
"defaultStatus": "affected",
"product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:cert_manager:1"
],
"defaultStatus": "affected",
"product": "cert-manager Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "affected",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:deployment_validator_operator"
],
"defaultStatus": "affected",
"product": "Deployment Validation Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:dynamic_accelerator_slicer:1"
],
"defaultStatus": "affected",
"product": "Dynamic Accelerator Slicer Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ext_dns_optr:1"
],
"defaultStatus": "affected",
"product": "ExternalDNS Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_file_integrity_operator:1"
],
"defaultStatus": "affected",
"product": "File Integrity Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:gatekeeper:3"
],
"defaultStatus": "affected",
"product": "Gatekeeper 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:job_set:0"
],
"defaultStatus": "affected",
"product": "Job Set Tech Preview",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:kernel_module_management:2"
],
"defaultStatus": "affected",
"product": "Kernel Module Management Operator for Red Hat Openshift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:kube_descheduler_operator:4"
],
"defaultStatus": "affected",
"product": "Kube Descheduler Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:leader_worker_set:1"
],
"defaultStatus": "affected",
"product": "Leader Worker Set",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:lvms:4"
],
"defaultStatus": "affected",
"product": "Logical Volume Manager Storage",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhmt:1"
],
"defaultStatus": "affected",
"product": "Migration Toolkit for Containers",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:migration_toolkit_virtualization:2"
],
"defaultStatus": "affected",
"product": "Migration Toolkit for Virtualization",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "affected",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_globalhub"
],
"defaultStatus": "affected",
"product": "Multicluster Global Hub",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1"
],
"defaultStatus": "affected",
"product": "OpenShift API for Data Protection",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
],
"defaultStatus": "affected",
"product": "OpenShift Pipelines",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:run_once_duration_override_operator:1"
],
"defaultStatus": "affected",
"product": "OpenShift Run Once Duration Override Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_secondary_scheduler:1"
],
"defaultStatus": "affected",
"product": "OpenShift Secondary Scheduler Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:2"
],
"defaultStatus": "affected",
"product": "OpenShift Service Mesh 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
],
"defaultStatus": "affected",
"product": "Red Hat Build of Podman Desktop",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:podman_desktop:0"
],
"defaultStatus": "affected",
"product": "Red Hat Build of Podman Desktop - Tech Preview",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:certifications:9"
],
"defaultStatus": "affected",
"product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:connectivity_link:1"
],
"defaultStatus": "affected",
"product": "Red Hat Connectivity Link 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:edge_manager:1"
],
"defaultStatus": "affected",
"product": "Red Hat Edge Manager 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_cluster_manager_cli:1"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Cluster Manager CLI",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_gitops:1"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift GitOps",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openstack:16.2"
],
"defaultStatus": "affected",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "affected",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_security_profiles_operator:1"
],
"defaultStatus": "affected",
"product": "Security Profiles Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:workload_availability_snr:0"
],
"defaultStatus": "affected",
"product": "Self Node Remediation Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:workload_availability_sbr:0"
],
"defaultStatus": "affected",
"product": "Storage-Based Remediation",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:0"
],
"defaultStatus": "affected",
"product": "Zero Trust Workload Identity Manager - Tech Preview",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_builds:1"
],
"defaultStatus": "unaffected",
"product": "Builds for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:confidential_compute_attestation:1"
],
"defaultStatus": "unaffected",
"product": "Confidential Compute Attestation",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
],
"defaultStatus": "unaffected",
"product": "Custom Metric Autoscaler operator for Red Hat Openshift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:external_secrets_operator:1"
],
"defaultStatus": "unaffected",
"product": "External Secrets Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:workload_availability_mdr:0"
],
"defaultStatus": "unaffected",
"product": "Machine Deletion Remediation Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8"
],
"defaultStatus": "unaffected",
"product": "Migration Toolkit for Applications 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3"
],
"defaultStatus": "unaffected",
"product": "OpenShift Service Mesh 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_power_monitoring"
],
"defaultStatus": "unaffected",
"product": "Power monitoring for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "unaffected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:kueue_operator:1"
],
"defaultStatus": "unaffected",
"product": "Red Hat Build of Kueue",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:devworkspace"
],
"defaultStatus": "unaffected",
"product": "Red Hat OpenShift Dev Workspaces Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:windows_machine_config"
],
"defaultStatus": "unaffected",
"product": "Red Hat OpenShift for Windows Containers",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "unaffected",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_interconnect:1"
],
"defaultStatus": "unaffected",
"product": "Red Hat Service Interconnect 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:trusted_profile_analyzer:2"
],
"defaultStatus": "unaffected",
"product": "Red Hat Trusted Profile Analyzer",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:stf:1.5"
],
"defaultStatus": "unaffected",
"product": "Service Telemetry Framework 1.5",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:1"
],
"defaultStatus": "unaffected",
"product": "Zero Trust Workload Identity Manager",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-20T22:23:32.147Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-551",
"description": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T12:04:52.878Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"name": "RHBZ#2449833",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29079"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26997"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27076"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17789"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28047"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20436"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18068"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20322"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26999"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19719"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27856"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19135"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10107"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19721"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19720"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27712"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10705"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10706"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19353"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19207"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9872"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34364"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22347"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21769"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6428"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29854"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8433"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22645"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25127"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13548"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8151"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11408"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11803"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13829"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7110"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11070"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7128"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13791"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27893"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27901"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27957"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27892"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6174"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6802"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22485"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24977"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10698"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19712"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10155"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10158"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21696"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21697"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12283"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21691"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21692"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28893"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25009"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:15092"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23234"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28964"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23235"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14775"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25045"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29082"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20088"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20089"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10105"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17598"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17599"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21657"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25182"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21658"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27001"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17448"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25183"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12119"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12118"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8449"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23246"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20041"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20042"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27004"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23247"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25201"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10093"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10094"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21703"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27063"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17468"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24535"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21704"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25195"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25194"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6564"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24759"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17474"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21709"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24506"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20034"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20035"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25187"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7245"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23241"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17475"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21710"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22800"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20946"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20943"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26519"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24484"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21932"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21931"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8483"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9440"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8484"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9448"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8490"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9453"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9388"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26416"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26420"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26413"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12279"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12277"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11916"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11856"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21017"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24853"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22465"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11996"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10131"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10125"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10130"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10126"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10172"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10153"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8338"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22959"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22961"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24536"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19099"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12116"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12337"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19108"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17459"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17123"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22689"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18585"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19109"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:29079: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:26997: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:27076: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:17789: Cryostat 4 on RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:28047: Red Hat OpenStack Platform 17.1"
},
{
"lang": "en",
"value": "RHSA-2026:20436: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:18068: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:20322: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:26999: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:19719: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:27856: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:22937: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19135: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:22450: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:10107: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:19721: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:19720: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:27712: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:10705: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:10706: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:23228: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19353: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:22714: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19207: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:9872: DevWorkspace Operator 0.4"
},
{
"lang": "en",
"value": "RHSA-2026:34364: Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"lang": "en",
"value": "RHSA-2026:22423: Multicluster Global Hub 1.3.4"
},
{
"lang": "en",
"value": "RHSA-2026:22347: Multicluster Global Hub 1.4.5"
},
{
"lang": "en",
"value": "RHSA-2026:21769: Multicluster Global Hub 1.5.4"
},
{
"lang": "en",
"value": "RHSA-2026:23345: Multicluster Global Hub 1.6.2"
},
{
"lang": "en",
"value": "RHSA-2026:6428: Network Observability (NETOBSERV) 1.11.2"
},
{
"lang": "en",
"value": "RHSA-2026:29854: OpenShift API for Data Protection 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:26568: OpenShift API for Data Protection 1.5"
},
{
"lang": "en",
"value": "RHSA-2026:8433: OpenShift Compliance Operator 1"
},
{
"lang": "en",
"value": "RHSA-2026:22645: Red Hat Advanced Cluster Management for Kubernetes 2.13"
},
{
"lang": "en",
"value": "RHSA-2026:25127: Red Hat Advanced Cluster Management for Kubernetes 2.14"
},
{
"lang": "en",
"value": "RHSA-2026:13548: Red Hat Advanced Cluster Management for Kubernetes 2.15"
},
{
"lang": "en",
"value": "RHSA-2026:8151: Red Hat Advanced Cluster Management for Kubernetes 2.15"
},
{
"lang": "en",
"value": "RHSA-2026:11408: Red Hat Advanced Cluster Management for Kubernetes 2.15"
},
{
"lang": "en",
"value": "RHSA-2026:11803: Red Hat Advanced Cluster Management for Kubernetes 2.16"
},
{
"lang": "en",
"value": "RHSA-2026:13829: Red Hat Advanced Cluster Security for Kubernetes 4.10"
},
{
"lang": "en",
"value": "RHSA-2026:7110: Red Hat Advanced Cluster Security for Kubernetes 4.8"
},
{
"lang": "en",
"value": "RHSA-2026:11070: Red Hat Advanced Cluster Security for Kubernetes 4.8"
},
{
"lang": "en",
"value": "RHSA-2026:7128: Red Hat Advanced Cluster Security for Kubernetes 4.9"
},
{
"lang": "en",
"value": "RHSA-2026:13791: Red Hat Advanced Cluster Security for Kubernetes 4.9"
},
{
"lang": "en",
"value": "RHSA-2026:27893: Red Hat Container Native Virtualization 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:27901: Red Hat Container Native Virtualization 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:27957: Red Hat Container Native Virtualization 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:27892: Red Hat Container Native Virtualization 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:6174: Red Hat Developer Hub 1.8"
},
{
"lang": "en",
"value": "RHSA-2026:6802: Red Hat Developer Hub 1.9"
},
{
"lang": "en",
"value": "RHSA-2026:22485: Red Hat Lightspeed (formerly Insights) for Runtimes 1"
},
{
"lang": "en",
"value": "RHSA-2026:24977: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:10698: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:19712: Red Hat OpenShift AI 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:10155: Red Hat OpenShift Builds 1.6.5"
},
{
"lang": "en",
"value": "RHSA-2026:10158: Red Hat OpenShift Builds 1.7.3"
},
{
"lang": "en",
"value": "RHSA-2026:21696: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:21697: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:12283: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:21691: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:21692: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:28893: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:25009: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:15092: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:23234: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:28964: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:23235: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:14775: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:25045: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:29082: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:20088: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:20089: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:10105: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:17598: Red Hat OpenShift Container Platform 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:17599: Red Hat OpenShift Container Platform 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:21657: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:25182: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:21658: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:27001: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:17448: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:25183: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:12119: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:12118: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:8449: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:23246: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:20041: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:20042: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:27004: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:23247: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:25201: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:10093: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:10094: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:21703: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:27063: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:17468: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:24535: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:21704: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:25195: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:25194: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:6564: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:24759: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:17474: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:21709: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:24506: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:20034: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:20035: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:25187: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:7245: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:23241: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:17475: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:21710: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:22800: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27"
},
{
"lang": "en",
"value": "RHSA-2026:20946: Red Hat OpenShift GitOps 1.18"
},
{
"lang": "en",
"value": "RHSA-2026:20943: Red Hat OpenShift GitOps 1.19"
},
{
"lang": "en",
"value": "RHSA-2026:26519: Red Hat OpenShift Pipelines 1.21"
},
{
"lang": "en",
"value": "RHSA-2026:24484: Red Hat OpenShift Pipelines 1.21"
},
{
"lang": "en",
"value": "RHSA-2026:21932: Red Hat OpenShift Pipelines 1.2"
},
{
"lang": "en",
"value": "RHSA-2026:21931: Red Hat OpenShift Pipelines 1.2"
},
{
"lang": "en",
"value": "RHSA-2026:8483: Red Hat OpenShift Service Mesh 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:9440: Red Hat OpenShift Service Mesh 3.0"
},
{
"lang": "en",
"value": "RHSA-2026:8484: Red Hat OpenShift Service Mesh 3.0"
},
{
"lang": "en",
"value": "RHSA-2026:9448: Red Hat OpenShift Service Mesh 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:8490: Red Hat OpenShift Service Mesh 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:9453: Red Hat OpenShift Service Mesh 3.2"
},
{
"lang": "en",
"value": "RHSA-2026:8491: Red Hat OpenShift Service Mesh 3.2"
},
{
"lang": "en",
"value": "RHSA-2026:8493: Red Hat OpenShift Service Mesh 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:9388: Red Hat OpenShift distributed tracing 3.9.3"
},
{
"lang": "en",
"value": "RHSA-2026:9385: Red Hat OpenShift distributed tracing 3.9.3"
},
{
"lang": "en",
"value": "RHSA-2026:26416: Red Hat Openshift Data Foundation 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:26420: Red Hat Openshift Data Foundation 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:26413: Red Hat Openshift Data Foundation 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:12279: Red Hat Openshift Data Foundation 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:26412: Red Hat Openshift Data Foundation 4.2"
},
{
"lang": "en",
"value": "RHSA-2026:12277: Red Hat Openshift Data Foundation 4.2"
},
{
"lang": "en",
"value": "RHSA-2026:11916: Red Hat Quay 3.10"
},
{
"lang": "en",
"value": "RHSA-2026:11856: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:21017: Red Hat Quay 3.14"
},
{
"lang": "en",
"value": "RHSA-2026:24853: Red Hat Quay 3.15"
},
{
"lang": "en",
"value": "RHSA-2026:19375: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:22465: Red Hat Quay 3.17"
},
{
"lang": "en",
"value": "RHSA-2026:11996: Red Hat Quay 3.9"
},
{
"lang": "en",
"value": "RHSA-2026:10131: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:10125: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:10130: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:10126: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:10172: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:10153: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:8338: Red Hat Web Terminal 1.13"
},
{
"lang": "en",
"value": "RHSA-2026:22959: Red Hat Web Terminal 1.14"
},
{
"lang": "en",
"value": "RHSA-2026:22961: Red Hat Web Terminal 1.15"
},
{
"lang": "en",
"value": "RHSA-2026:24536: multicluster engine for Kubernetes 2.10"
},
{
"lang": "en",
"value": "RHSA-2026:19099: multicluster engine for Kubernetes 2.10"
},
{
"lang": "en",
"value": "RHSA-2026:12116: multicluster engine for Kubernetes 2.10"
},
{
"lang": "en",
"value": "RHSA-2026:12337: multicluster engine for Kubernetes 2.11"
},
{
"lang": "en",
"value": "RHSA-2026:19108: multicluster engine for Kubernetes 2.11"
},
{
"lang": "en",
"value": "RHSA-2026:17459: multicluster engine for Kubernetes 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:17123: multicluster engine for Kubernetes 2.8"
},
{
"lang": "en",
"value": "RHSA-2026:22689: multicluster engine for Kubernetes 2.8"
},
{
"lang": "en",
"value": "RHSA-2026:18585: multicluster engine for Kubernetes 2.9"
},
{
"lang": "en",
"value": "RHSA-2026:19109: multicluster engine for Kubernetes 2.9"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-20T23:02:27.802Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-20T22:23:32.147Z",
"value": "Made public."
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "grpc-go",
"vendor": "grpc",
"versions": [
{
"status": "affected",
"version": "\u003c 1.79.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-20T22:23:32.147Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"source": {
"advisory": "GHSA-p77j-4mvh-x3m3",
"discovery": "UNKNOWN"
},
"title": "gRPC-Go has an authorization bypass via missing leading slash in :path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33186",
"datePublished": "2026-03-20T22:23:32.147Z",
"dateReserved": "2026-03-17T22:16:36.720Z",
"dateUpdated": "2026-07-03T12:04:52.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-33186",
"date": "2026-07-05",
"epss": "0.01557",
"percentile": "0.7219"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-33186\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-20T23:16:45.180\",\"lastModified\":\"2026-07-02T12:17:04.470\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \\\"deny\\\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \\\"allow\\\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \\\"deny\\\" rules for canonical paths but allows other requests by default (a fallback \\\"allow\\\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.\"},{\"lang\":\"es\",\"value\":\"gRPC-Go es la implementaci\u00f3n en lenguaje Go de gRPC. Las versiones anteriores a la 1.79.3 tienen un bypass de autorizaci\u00f3n resultante de una validaci\u00f3n de entrada incorrecta del pseudo-encabezado HTTP/2 \u0027:path\u0027. El servidor gRPC-Go era demasiado indulgente en su l\u00f3gica de enrutamiento, aceptando solicitudes donde el \u0027:path\u0027 omit\u00eda la barra inicial obligatoria (por ejemplo, \u0027Service/Method\u0027 en lugar de \u0027/Service/Method\u0027). Si bien el servidor enrut\u00f3 con \u00e9xito estas solicitudes al gestor correcto, los interceptores de autorizaci\u00f3n (incluido el paquete oficial \u0027grpc/authz\u0027) evaluaron la cadena de ruta cruda y no can\u00f3nica. En consecuencia, las reglas de \u0027denegaci\u00f3n\u0027 definidas usando rutas can\u00f3nicas (que comienzan con \u0027/\u0027) no lograron coincidir con la solicitud entrante, permitiendo que bypassara la pol\u00edtica si una regla de \u0027permiso\u0027 de respaldo estaba presente. Esto afecta a los servidores gRPC-Go que utilizan interceptores de autorizaci\u00f3n basados en rutas, como la implementaci\u00f3n oficial de RBAC en \u0027google.golang.org/grpc/authz\u0027 o interceptores personalizados que dependen de \u0027info.FullMethod\u0027 o \u0027grpc.Method(ctx)\u0027; Y que tienen una pol\u00edtica de seguridad que contiene reglas de \u0027denegaci\u00f3n\u0027 espec\u00edficas para rutas can\u00f3nicas pero permite otras solicitudes por defecto (una regla de \u0027permiso\u0027 de respaldo). La vulnerabilidad es explotable por un atacante que puede enviar tramas HTTP/2 crudas con encabezados \u0027:path\u0027 malformados directamente al servidor gRPC. La correcci\u00f3n en la versi\u00f3n 1.79.3 asegura que cualquier solicitud con un \u0027:path\u0027 que no comience con una barra inicial sea inmediatamente rechazada con un error \u0027codes.Unimplemented\u0027, impidiendo que llegue a los interceptores de autorizaci\u00f3n o gestores con una cadena de ruta no can\u00f3nica. Si bien la actualizaci\u00f3n es la ruta m\u00e1s segura y recomendada, los usuarios pueden mitigar la vulnerabilidad utilizando uno de los siguientes m\u00e9todos: Usar un interceptor de validaci\u00f3n (mitigaci\u00f3n recomendada); normalizaci\u00f3n a nivel de infraestructura; y/o endurecimiento de pol\u00edticas.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"grpc\",\"product\":\"grpc-go\",\"versions\":[{\"version\":\"\u003c 1.79.3\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.16\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.16::el8\",\"cpe:/a:redhat:openshift:4.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.18\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.18::el8\",\"cpe:/a:redhat:openshift:4.18::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el8\",\"cpe:/a:redhat:satellite_capsule:6.16::el8\",\"cpe:/a:redhat:satellite_maintenance:6.16::el8\",\"cpe:/a:redhat:satellite_utils:6.16::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4 on RHEL 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:cryostat:4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\",\"cpe:/a:redhat:openstack:17.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el9\",\"cpe:/a:redhat:satellite_capsule:6.16::el9\",\"cpe:/a:redhat:satellite_maintenance:6.16::el9\",\"cpe:/a:redhat:satellite_utils:6.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS (v. 10.0)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 10)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS (v.9.4)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.4::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream EUS (v.9.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 9)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat CodeReady Linux Builder EUS (v.9.6)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6::crb\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::crb\"]},{\"vendor\":\"Red Hat\",\"product\":\"DevWorkspace Operator 0.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:devworkspace:0.40::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift 6.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:logging:6.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.3.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.4.5\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.5.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.6.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.6::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability (NETOBSERV) 1.11.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1.11::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection 1.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection 1.5\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1.5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Compliance Operator 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_compliance_operator:1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.13\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2.13::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.14\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2.14::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2.15::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.16\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.8::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.18\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.18::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.19\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.19::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.20\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.20::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Container Native Virtualization 4.21\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4.21::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub 1.8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhdh:1.8::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub 1.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhdh:1.9::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Lightspeed (formerly Insights) for Runtimes 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Builds 1.6.5\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_builds:1.6::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Builds 1.7.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_builds:1.7::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.12\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.12::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.13\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.13::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.14\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.14::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.15::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.17\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.17::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.20\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.20::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.21\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.21::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.27\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.18\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.18::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.19\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.19::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Pipelines 1.21\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1.21::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Pipelines 1.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1.20::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 2.6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2.6::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.0\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.2::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift distributed tracing 3.9.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_distributed_tracing:3.9::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.16\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.18\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.18::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.19\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.19::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.10::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.12\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.12::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.14\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.14::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.15::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.17\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.17::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3.9::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.13\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.13::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.14\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.14::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.15\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.15::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.10::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.11\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.11::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.6::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.8::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.9::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Assisted Installer for Red Hat OpenShift Container Platform 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:assisted_installer:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"cert-manager Operator for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:cert_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Deployment Validation Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:deployment_validator_operator\"]},{\"vendor\":\"Red Hat\",\"product\":\"Dynamic Accelerator Slicer Operator for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:dynamic_accelerator_slicer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"ExternalDNS Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ext_dns_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"File Integrity Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_file_integrity_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Gatekeeper 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:gatekeeper:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Job Set Tech Preview\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:job_set:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Kernel Module Management Operator for Red Hat Openshift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:kernel_module_management:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Kube Descheduler Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:kube_descheduler_operator:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Leader Worker Set\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:leader_worker_set:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logical Volume Manager Storage\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:lvms:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Containers\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhmt:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Virtualization\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_virtualization:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Pipelines\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Run Once Duration Override Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:run_once_duration_override_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Secondary Scheduler Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_secondary_scheduler:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Podman Desktop\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:podman_desktop:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Podman Desktop - Tech Preview\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:podman_desktop:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Certification Program for Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:certifications:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Connectivity Link 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:connectivity_link:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Edge Manager 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Cluster Manager CLI\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_cluster_manager_cli:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openstack:16.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Security Profiles Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_security_profiles_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Self Node Remediation Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:workload_availability_snr:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Storage-Based Remediation\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:workload_availability_sbr:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager - Tech Preview\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Builds for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:openshift_builds:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Confidential Compute Attestation\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:confidential_compute_attestation:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Custom Metric Autoscaler operator for Red Hat Openshift\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"External Secrets Operator for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:external_secrets_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Machine Deletion Remediation Operator\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:workload_availability_mdr:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Applications 8\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_applications:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 3\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Power monitoring for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:openshift_power_monitoring\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Kueue\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:kueue_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Workspaces Operator\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:devworkspace\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift for Windows Containers\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:windows_machine_config\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Service Interconnect 1\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:service_interconnect:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Profile Analyzer\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:trusted_profile_analyzer:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Service Telemetry Framework 1.5\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:stf:1.5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-24T18:08:38.989284Z\",\"id\":\"CVE-2026-33186\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-551\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*\",\"versionEndExcluding\":\"1.79.3\",\"matchCriteriaId\":\"D5AB3ED0-D11B-461E-B2B1-627D5CCEA236\"}]}]}],\"references\":[{\"url\":\"https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10093\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10094\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10105\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10107\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10125\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10126\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10130\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10131\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10153\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10155\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10158\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10172\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10175\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10698\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10705\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10706\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11070\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11408\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11803\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11856\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11916\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11996\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12116\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12118\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12119\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12277\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12279\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12283\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12337\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13548\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13791\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13829\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14775\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:15092\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17123\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17448\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17459\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17468\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17474\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17475\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17598\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17599\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17789\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18068\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18585\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19099\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19108\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19109\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19135\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19207\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19353\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19375\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19712\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19719\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19720\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19721\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20034\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20035\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20041\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20042\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20088\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20089\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20322\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20436\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20943\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20946\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21017\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21657\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21658\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21691\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21692\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21696\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21697\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21703\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21704\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21709\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21710\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21769\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21931\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21932\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22347\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22423\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22450\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22465\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22485\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22645\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22689\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22714\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22800\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22937\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22959\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22961\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23228\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23234\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23235\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23241\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23246\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23247\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23345\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24484\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24506\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24535\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24536\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24759\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24853\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24977\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25009\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25045\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25127\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25182\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25183\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25187\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25194\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25195\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25201\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26412\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26413\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26416\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26420\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26519\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26568\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26997\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26999\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27001\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27004\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27063\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27076\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27712\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27856\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27892\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27893\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27901\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27957\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28047\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28893\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28964\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29079\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29082\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29854\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34364\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6174\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6428\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6564\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6802\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7110\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7128\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7245\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8151\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8338\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8433\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8449\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8483\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8484\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8490\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8491\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8493\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9385\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9388\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9440\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9448\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9453\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9872\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-33186\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2449833\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:openshift:4.16::el8\", \"cpe:/a:redhat:openshift:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.18::el8\", \"cpe:/a:redhat:openshift:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.18\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el8\", \"cpe:/a:redhat:satellite_capsule:6.16::el8\", \"cpe:/a:redhat:satellite_maintenance:6.16::el8\", \"cpe:/a:redhat:satellite_utils:6.16::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4 on RHEL 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\", \"cpe:/a:redhat:openstack:17.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.19\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el9\", \"cpe:/a:redhat:satellite_capsule:6.16::el9\", \"cpe:/a:redhat:satellite_maintenance:6.16::el9\", \"cpe:/a:redhat:satellite_utils:6.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS (v. 10.0)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 10)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS (v.9.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS (v.9.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 9)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat CodeReady Linux Builder EUS (v.9.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:devworkspace:0.40::el9\"], \"vendor\": \"Red Hat\", \"product\": \"DevWorkspace Operator 0.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift 6.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.3.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.4.5\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.5.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.6.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability (NETOBSERV) 1.11.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection 1.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection 1.5\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_compliance_operator:1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Compliance Operator 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.13\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.14\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.8::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.18\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.19\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.20\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Container Native Virtualization 4.21\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub 1.8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub 1.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Lightspeed (formerly Insights) for Runtimes 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_builds:1.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Builds 1.6.5\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_builds:1.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Builds 1.7.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.12::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.12\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.13\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.14\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.17\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.20\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.21\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.27\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.18::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.18\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.19::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.19\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Pipelines 1.21\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Pipelines 1.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2.6::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 2.6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.0\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_distributed_tracing:3.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift distributed tracing 3.9.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.18\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.19\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.12\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.14::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.14\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.17\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.13\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.14\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.10::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.11\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.6::el8\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:assisted_installer:2\"], \"vendor\": \"Red Hat\", \"product\": \"Assisted Installer for Red Hat OpenShift Container Platform 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cert_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"cert-manager Operator for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:deployment_validator_operator\"], \"vendor\": \"Red Hat\", \"product\": \"Deployment Validation Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:dynamic_accelerator_slicer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Dynamic Accelerator Slicer Operator for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ext_dns_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"ExternalDNS Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_file_integrity_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"File Integrity Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:gatekeeper:3\"], \"vendor\": \"Red Hat\", \"product\": \"Gatekeeper 3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:job_set:0\"], \"vendor\": \"Red Hat\", \"product\": \"Job Set Tech Preview\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:kernel_module_management:2\"], \"vendor\": \"Red Hat\", \"product\": \"Kernel Module Management Operator for Red Hat Openshift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:kube_descheduler_operator:4\"], \"vendor\": \"Red Hat\", \"product\": \"Kube Descheduler Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:leader_worker_set:1\"], \"vendor\": \"Red Hat\", \"product\": \"Leader Worker Set\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lvms:4\"], \"vendor\": \"Red Hat\", \"product\": \"Logical Volume Manager Storage\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhmt:1\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Containers\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_virtualization:2\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Virtualization\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Pipelines\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:run_once_duration_override_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Run Once Duration Override Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_secondary_scheduler:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Secondary Scheduler Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:podman_desktop:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Podman Desktop\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:podman_desktop:0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Podman Desktop - Tech Preview\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:certifications:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Certification Program for Red Hat Enterprise Linux 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:connectivity_link:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Connectivity Link 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Edge Manager 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_cluster_manager_cli:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Cluster Manager CLI\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:16.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 16.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_security_profiles_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"Security Profiles Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_snr:0\"], \"vendor\": \"Red Hat\", \"product\": \"Self Node Remediation Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_sbr:0\"], \"vendor\": \"Red Hat\", \"product\": \"Storage-Based Remediation\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_builds:1\"], \"vendor\": \"Red Hat\", \"product\": \"Builds for Red Hat OpenShift\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:confidential_compute_attestation:1\"], \"vendor\": \"Red Hat\", \"product\": \"Confidential Compute Attestation\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2\"], \"vendor\": \"Red Hat\", \"product\": \"Custom Metric Autoscaler operator for Red Hat Openshift\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:external_secrets_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"External Secrets Operator for Red Hat OpenShift\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_mdr:0\"], \"vendor\": \"Red Hat\", \"product\": \"Machine Deletion Remediation Operator\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_applications:8\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Applications 8\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 3\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_power_monitoring\"], \"vendor\": \"Red Hat\", \"product\": \"Power monitoring for Red Hat OpenShift\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:kueue_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Kueue\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:devworkspace\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Workspaces Operator\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:windows_machine_config\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift for Windows Containers\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_interconnect:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Service Interconnect 1\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_profile_analyzer:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Profile Analyzer\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:stf:1.5\"], \"vendor\": \"Red Hat\", \"product\": \"Service Telemetry Framework 1.5\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-03-20T23:02:27.802Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-03-20T22:23:32.147Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:29079: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26997: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27076: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17789: Cryostat 4 on RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28047: Red Hat OpenStack Platform 17.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20436: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18068: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20322: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26999: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19719: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27856: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22937: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19135: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22450: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10107: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19721: Red Hat Enterprise Linux AppStream EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19720: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27712: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10705: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10706: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23228: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19353: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22714: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19207: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9872: DevWorkspace Operator 0.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34364: Logging Subsystem for Red Hat OpenShift 6.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22423: Multicluster Global Hub 1.3.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22347: Multicluster Global Hub 1.4.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21769: Multicluster Global Hub 1.5.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23345: Multicluster Global Hub 1.6.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6428: Network Observability (NETOBSERV) 1.11.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29854: OpenShift API for Data Protection 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26568: OpenShift API for Data Protection 1.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8433: OpenShift Compliance Operator 1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22645: Red Hat Advanced Cluster Management for Kubernetes 2.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25127: Red Hat Advanced Cluster Management for Kubernetes 2.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13548: Red Hat Advanced Cluster Management for Kubernetes 2.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8151: Red Hat Advanced Cluster Management for Kubernetes 2.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11408: Red Hat Advanced Cluster Management for Kubernetes 2.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11803: Red Hat Advanced Cluster Management for Kubernetes 2.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13829: Red Hat Advanced Cluster Security for Kubernetes 4.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7110: Red Hat Advanced Cluster Security for Kubernetes 4.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11070: Red Hat Advanced Cluster Security for Kubernetes 4.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7128: Red Hat Advanced Cluster Security for Kubernetes 4.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13791: Red Hat Advanced Cluster Security for Kubernetes 4.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27893: Red Hat Container Native Virtualization 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27901: Red Hat Container Native Virtualization 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27957: Red Hat Container Native Virtualization 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27892: Red Hat Container Native Virtualization 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6174: Red Hat Developer Hub 1.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6802: Red Hat Developer Hub 1.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22485: Red Hat Lightspeed (formerly Insights) for Runtimes 1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24977: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10698: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19712: Red Hat OpenShift AI 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10155: Red Hat OpenShift Builds 1.6.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10158: Red Hat OpenShift Builds 1.7.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21696: Red Hat OpenShift Container Platform 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21697: Red Hat OpenShift Container Platform 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12283: Red Hat OpenShift Container Platform 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21691: Red Hat OpenShift Container Platform 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21692: Red Hat OpenShift Container Platform 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28893: Red Hat OpenShift Container Platform 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25009: Red Hat OpenShift Container Platform 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:15092: Red Hat OpenShift Container Platform 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23234: Red Hat OpenShift Container Platform 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28964: Red Hat OpenShift Container Platform 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23235: Red Hat OpenShift Container Platform 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14775: Red Hat OpenShift Container Platform 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25045: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29082: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20088: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20089: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10105: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17598: Red Hat OpenShift Container Platform 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17599: Red Hat OpenShift Container Platform 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21657: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25182: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21658: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27001: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17448: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25183: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12119: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12118: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8449: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23246: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20041: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20042: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27004: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23247: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25201: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10093: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10094: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21703: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27063: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17468: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24535: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21704: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25195: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25194: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6564: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24759: Red Hat OpenShift Container Platform 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17474: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21709: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24506: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20034: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20035: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25187: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7245: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23241: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17475: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21710: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22800: Red Hat OpenShift Container Platform 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20946: Red Hat OpenShift GitOps 1.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20943: Red Hat OpenShift GitOps 1.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26519: Red Hat OpenShift Pipelines 1.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24484: Red Hat OpenShift Pipelines 1.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21932: Red Hat OpenShift Pipelines 1.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21931: Red Hat OpenShift Pipelines 1.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8483: Red Hat OpenShift Service Mesh 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9440: Red Hat OpenShift Service Mesh 3.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8484: Red Hat OpenShift Service Mesh 3.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9448: Red Hat OpenShift Service Mesh 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8490: Red Hat OpenShift Service Mesh 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9453: Red Hat OpenShift Service Mesh 3.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8491: Red Hat OpenShift Service Mesh 3.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8493: Red Hat OpenShift Service Mesh 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9388: Red Hat OpenShift distributed tracing 3.9.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9385: Red Hat OpenShift distributed tracing 3.9.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26416: Red Hat Openshift Data Foundation 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26420: Red Hat Openshift Data Foundation 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26413: Red Hat Openshift Data Foundation 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12279: Red Hat Openshift Data Foundation 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26412: Red Hat Openshift Data Foundation 4.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12277: Red Hat Openshift Data Foundation 4.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11916: Red Hat Quay 3.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11856: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21017: Red Hat Quay 3.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24853: Red Hat Quay 3.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19375: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22465: Red Hat Quay 3.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11996: Red Hat Quay 3.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10131: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10125: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10130: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10126: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10172: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10153: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8338: Red Hat Web Terminal 1.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22959: Red Hat Web Terminal 1.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22961: Red Hat Web Terminal 1.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24536: multicluster engine for Kubernetes 2.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19099: multicluster engine for Kubernetes 2.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12116: multicluster engine for Kubernetes 2.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12337: multicluster engine for Kubernetes 2.11\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19108: multicluster engine for Kubernetes 2.11\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17459: multicluster engine for Kubernetes 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17123: multicluster engine for Kubernetes 2.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22689: multicluster engine for Kubernetes 2.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18585: multicluster engine for Kubernetes 2.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19109: multicluster engine for Kubernetes 2.9\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-03-20T22:23:32.147Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-33186\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2449833\", \"name\": \"RHBZ#2449833\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29079\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26997\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27076\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17789\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28047\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20436\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18068\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20322\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26999\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19719\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27856\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22937\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19135\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22450\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10107\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19721\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19720\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27712\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10705\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10706\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23228\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19353\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22714\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19207\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9872\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34364\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22423\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22347\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21769\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23345\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6428\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29854\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26568\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8433\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22645\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25127\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13548\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8151\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11408\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11803\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13829\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7110\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11070\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7128\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13791\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27893\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27901\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27957\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27892\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6174\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6802\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22485\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24977\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10698\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19712\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10155\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10158\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21696\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21697\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12283\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21691\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21692\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28893\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25009\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:15092\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23234\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28964\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23235\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14775\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25045\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29082\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20088\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20089\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10105\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17598\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17599\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21657\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25182\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21658\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27001\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17448\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25183\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12119\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12118\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8449\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23246\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20041\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20042\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27004\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23247\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25201\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10093\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10094\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21703\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27063\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17468\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24535\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21704\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25195\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25194\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6564\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24759\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17474\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21709\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24506\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20034\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20035\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25187\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7245\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23241\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17475\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21710\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22800\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10175\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20946\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20943\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26519\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24484\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21932\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21931\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8483\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9440\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8484\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9448\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8490\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9453\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8491\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8493\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9388\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9385\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26416\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26420\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26413\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12279\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26412\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12277\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11916\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11856\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21017\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24853\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19375\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22465\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11996\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10131\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10125\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10130\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10126\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10172\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10153\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8338\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22959\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22961\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24536\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19099\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12116\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12337\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19108\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17459\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17123\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22689\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18585\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19109\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-551\", \"description\": \"Incorrect Behavior Order: Authorization Before Parsing and Canonicalization\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-03T12:04:52.878Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33186\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-24T18:08:38.989284Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-24T18:09:03.096Z\"}}], \"cna\": {\"title\": \"gRPC-Go has an authorization bypass via missing leading slash in :path\", \"source\": {\"advisory\": \"GHSA-p77j-4mvh-x3m3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"grpc\", \"product\": \"grpc-go\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.79.3\"}]}], \"references\": [{\"url\": \"https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3\", \"name\": \"https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \\\"deny\\\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \\\"allow\\\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \\\"deny\\\" rules for canonical paths but allows other requests by default (a fallback \\\"allow\\\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285: Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-20T22:23:32.147Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-33186\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-03T12:04:52.878Z\", \"dateReserved\": \"2026-03-17T22:16:36.720Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-20T22:23:32.147Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:8491
Vulnerability from csaf_redhat - Published: 2026-04-16 14:30 - Updated: 2026-07-05 19:29Summary
Red Hat Security Advisory: Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2
Severity
Critical
Notes
Topic: Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2 is now available.
An update is now available for Red Hat OpenShift Service Mesh 3.2. This advisory contains the RPM packages for the Kiali component.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Kiali 2.17.6, for Red Hat OpenShift Service Mesh 3.2, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13235, OSSM-13236)
* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12922)
* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12900, OSSM-12901)
* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (OSSM-12980, OSSM-12981)
* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13018)
* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13122, OSSM-13123)
* CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13162)
* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13259, OSSM-13260)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
7.0 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
9.0 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
68 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2 is now available.\nAn update is now available for Red Hat OpenShift Service Mesh 3.2. This advisory contains the RPM packages for the Kiali component.\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kiali 2.17.6, for Red Hat OpenShift Service Mesh 3.2, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13235, OSSM-13236)\n* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12922)\n* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12900, OSSM-12901)\n* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) (OSSM-12980, OSSM-12981)\n* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13018)\n* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13122, OSSM-13123)\n* CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13162)\n* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13259, OSSM-13260)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8491",
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8491.json"
}
],
"title": "Red Hat Security Advisory: Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2",
"tracking": {
"current_release_date": "2026-07-05T19:29:16+00:00",
"generator": {
"date": "2026-07-05T19:29:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:8491",
"initial_release_date": "2026-04-16T14:30:52+00:00",
"revision_history": [
{
"date": "2026-04-16T14:30:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-16T14:31:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-05T19:29:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.2",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776149682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ae43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776155669"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776149682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776155669"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Ada74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776149682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776155669"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776149682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776155669"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-40175",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-10T20:02:10.296601+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Axios library, a promise-based HTTP client, is susceptible to an Important prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.\n\nThe openshift4/ose-monitoring-plugin-rhel9 container image is not vulnerable to this flaw. The affected component is used as a build-time dependency but it\u0027s not shipped in the final product, meaning the flaw is not present thus cannot be exploited in the container deployments.\n\nRegarding openshift4/ose-console for Product stream 4.12 and 4.13, the vulnerable component is present (indirect dependency), but the vulnerability is not exploitable in our case due to the browser runtime, where the required Node.js-specific attack vectors are not available. With this, the impact becomes low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "RHBZ#2457432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
"url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10660",
"url": "https://github.com/axios/axios/pull/10660"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
}
],
"release_date": "2026-04-10T19:23:52.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:30:52+00:00",
"details": "See Kiali 2.17.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8491"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:23b96190a7c4ed61dc20ed81a11f99096af177b3eec5af90fadc1cb3f098ad34_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2cbbcb77e7c104996fa49917515cf0150474f72092633871f9a6020a49e62b3f_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:9189ec99cd763c438e7c2c4f5669283021c0513d9b0aaf6173d91702c140e162_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e43c69758c022a2ce3e61d5f7d223be39b42f4d9b7d4fae6a1226d8e36cb38c9_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:0227a1bbf4d38482ddb9df144b0a78d1c0dda91517e8b1bbed10dc8fcb30ece6_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4309ccac390fa120a821547fa34cc7096b266295d60218dd65f066143b53e0bc_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:841225db46ae16da39452a4457be2e30cfc94f6020e6292c8b7e5c492f016d52_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:da74bc8c1c41d7d96aeb947df89aecd1ccd6760c98944ae112af65d9df85f220_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
}
]
}
RHSA-2026:8493
Vulnerability from csaf_redhat - Published: 2026-04-16 14:41 - Updated: 2026-07-05 19:29Summary
Red Hat Security Advisory: Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3
Severity
Critical
Notes
Topic: Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3 is now available.
An update is now available for Red Hat OpenShift Service Mesh 3.3. This advisory contains the RPM packages for the Kiali component.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Kiali 2.22.2, for Red Hat OpenShift Service Mesh 3.3, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13237, OSSM-13238)
* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-13272)
* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-13274, OSSM-13275)
* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (OSSM-13276, OSSM-13277, OSSM-13278)
* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13279, OSSM-13280)
* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13281, OSSM-13282)
* CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13283)
* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13284, OSSM-13285)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
7.0 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Threats
Impact
Important
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
9.0 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 | — |
Threats
Impact
Important
References
68 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3 is now available.\nAn update is now available for Red Hat OpenShift Service Mesh 3.3. This advisory contains the RPM packages for the Kiali component.\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kiali 2.22.2, for Red Hat OpenShift Service Mesh 3.3, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13237, OSSM-13238)\n* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-13272)\n* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-13274, OSSM-13275)\n* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) (OSSM-13276, OSSM-13277, OSSM-13278)\n* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-13279, OSSM-13280)\n* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13281, OSSM-13282)\n* CVE-2026-34986 Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (OSSM-13283)\n* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13284, OSSM-13285)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8493",
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8493.json"
}
],
"title": "Red Hat Security Advisory: Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3",
"tracking": {
"current_release_date": "2026-07-05T19:29:16+00:00",
"generator": {
"date": "2026-07-05T19:29:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:8493",
"initial_release_date": "2026-04-16T14:41:31+00:00",
"revision_history": [
{
"date": "2026-04-16T14:41:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-16T14:41:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-05T19:29:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.3",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.3::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Adaa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151277"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-operator-bundle@sha256%3Ac93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776225903"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151094"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151134"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3Ace46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151277"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3Aa69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151094"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Afe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151134"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151277"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151094"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Aea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151134"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151277"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151094"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Afd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776151134"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
"product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-40175",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-10T20:02:10.296601+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Axios library, a promise-based HTTP client, is susceptible to an Important prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.\n\nThe openshift4/ose-monitoring-plugin-rhel9 container image is not vulnerable to this flaw. The affected component is used as a build-time dependency but it\u0027s not shipped in the final product, meaning the flaw is not present thus cannot be exploited in the container deployments.\n\nRegarding openshift4/ose-console for Product stream 4.12 and 4.13, the vulnerable component is present (indirect dependency), but the vulnerability is not exploitable in our case due to the browser runtime, where the required Node.js-specific attack vectors are not available. With this, the impact becomes low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "RHBZ#2457432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
"url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10660",
"url": "https://github.com/axios/axios/pull/10660"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
}
],
"release_date": "2026-04-10T19:23:52.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T14:41:31+00:00",
"details": "See Kiali 2.22.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8493"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:c93dae9691dc8dc27127f89c445a65c79f827af2af047f53484215b392c0d51f_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:27cf9029920456be99f8a4d03a0b45eea94a4c29ad4ceca663d5c87264d9cd02_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ea518811fcc9d723a1c8076216a6c4c57fd7f5eaf0860f9b688009a7b1078650_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fd22a9687dc53d555340d6eb203690e45f90f3096dbb9dd5ccae3c12b654dfe3_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fe2cb99f7ebdb875e25d699f1553b6616ddadede21c4881f4be4f841e51ccb27_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:202c1a86dd47f4f8c124e63e9dae4687b8fb450759171e73cd2158cd825bf6aa_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:69458a43dcd771a59c62ea33cd2624c8b2170a0f49ad849e5ddbaff606902aa1_amd64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:8d16db896ac1d5cc9db7a3fbbbad1913eacc6656373af73e26d432e54b7a3156_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:a69106c836d9c8d0d711ab618b1bde2c6d9f30ea278de4afc5b51c0ee27d628d_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe662754ea1d798925482785c355722e46f625ff2d22b65c186a35e7adee65a_s390x",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7e3bd934c479c704aa5bd07ca43ef3393e3c09a24e7dbb190e5d77758e72e4fa_ppc64le",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ce46c36d0b7a0a20214ea0152bb9894aa4626f23500e1c7a5e0ec696290a3bfd_arm64",
"Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:daa972852bddb585e4ff5fa28d41680bea204fb29cac28a8f354d1a93591ab0c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
}
]
}
RHSA-2026:9385
Vulnerability from csaf_redhat - Published: 2026-04-21 15:08 - Updated: 2026-07-05 19:29Summary
Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.9.2 release
Severity
Important
Notes
Topic: Red Hat OpenShift distributed tracing platform (Tempo) 3.9.2 has been released
Details: This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements and bug fixes.
Breaking changes:
* None.
Deprecations:
* None.
Technology Preview features:
* None.
Enhancements:
* None.
Bug fixes:
* gRPC-Go authorization bypass vulnerability fix: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 :path pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed :path that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the :path pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186.
* XPath component fix: Previously, the github.com/antchfx/xpath component did not properly handle certain Boolean XPath expressions. A remote attacker could submit a crafted expression that caused an infinite loop, resulting in 100% CPU utilization and a denial-of-service condition. With this update, the XPath component correctly processes Boolean expressions that evaluate to true. The system no longer enters an infinite loop when handling these expressions. For more information, see https://access.redhat.com/security/cve/cve-2026-4645.
* Go JOSE denial-of-service vulnerability fix: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial-of-service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986.
* Lodash _.template function fix: Previously, the lodash _.template function validated the variable option but did not validate options.imports key names. Both options passed values to the same code execution path. An attacker with the ability to control options.imports key names or pollute Object.prototype could exploit this gap to execute arbitrary code. With this update, lodash validates options.imports key names by using the same rules applied to the variable option. The _.template function rejects invalid key names and prevents code injection through this path. For more information, see https://access.redhat.com/security/cve/cve-2026-4800.
* Go crypto/x509 and crypto/tls packages fix: Previously, the Go standard library crypto/x509 and crypto/tls packages did not limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing the system to perform an uncontrolled amount of work and resulting in a denial-of-service condition. With this update, the packages limit the number of intermediate certificates accepted during certificate chain validation. The system rejects certificate chains that exceed this limit. For more information, see https://access.redhat.com/security/cve/cve-2026-32280.
* Go Root.Chmod function fix: Previously, the Root.Chmod function in the Go standard library internal/syscall/unix package had a race condition between checking and modifying a target file. An attacker could replace the target with a symbolic link after the check but before the operation completed, causing the permission change to apply to the linked file instead. This allowed an attacker to bypass directory restrictions and change permissions on unintended files. With this update, the Root.Chmod function prevents this race condition. The function no longer follows symbolic links that replace the target during execution. For more information, see https://access.redhat.com/security/cve/cve-2026-32282.
* Go crypto/x509 package fix: Previously, the Go crypto/x509 package applied excluded DNS constraints to wildcard Subject Alternative Names (SANs) in a case-sensitive manner. An attacker could bypass certificate validation by using a different case in the wildcard SAN than the excluded DNS constraint specified. This allowed the system to accept a malicious certificate that should have been rejected. With this update, the package applies DNS constraints case-insensitively when validating wildcard SANs. Certificate chain verification correctly rejects certificates that match excluded DNS constraints regardless of case. For more information, see https://access.redhat.com/security/cve/cve-2026-33810.
* Go crypto/tls component fix: Previously, the Go crypto/tls component did not re-validate certificates against updated certificate authority (CA) settings during TLS session resumption. If CA settings changed between the initial handshake and a resumed session, the component used the original CA settings. An attacker could exploit this to bypass certificate validation and establish a connection that should have been rejected. With this update, the component validates certificates against the current CA settings during session resumption. Resumed sessions that no longer meet CA requirements are rejected. For more information, see https://access.redhat.com/security/cve/cve-2025-68121.
* jsonparser Delete function fix: Previously, the Delete function in the github.com/buger/jsonparser component did not validate offsets when processing malformed JSON input. A remote attacker could provide crafted JSON data that caused a runtime panic, resulting in a denial-of-service condition. With this update, the Delete function validates offsets before processing. The function handles malformed JSON input as expected. For more information, see https://access.redhat.com/security/cve/cve-2026-32285.
* path-to-regexp component fix: Previously, the path-to-regexp component did not limit the complexity of generated regular expressions. A remote attacker could provide input containing multiple sequential optional groups, causing exponential growth in the generated expression and excessive resource consumption. This resulted in a denial-of-service condition. With this update, the component limits regular expression complexity. Input patterns with sequential optional groups no longer cause excessive resource consumption. For more information, see https://access.redhat.com/security/cve/cve-2026-4926.
* Go net/url.Parse function fix: Previously, the Go net/url.Parse function did not properly validate the host component of URLs containing IP-literals. The function ignored invalid characters preceding IP-literals and accepted URLs that should have been rejected. With this update, the function validates the entire host component. URLs with invalid characters before IP-literals are rejected as malformed. For more information, see https://access.redhat.com/security/cve/cve-2026-25679.
* Go crypto/x509 module fix: Previously, the Go crypto/x509 module did not apply all email address constraints when validating certificates. If a certificate contained multiple email constraints with the same local portion but different domain portions, the module only enforced the last constraint and ignored the others. With this update, the module applies all email address constraints during certificate chain validation. Certificates are validated against every specified email constraint. For more information, see https://access.redhat.com/security/cve/cve-2026-27137.
Known issues:
* Gateway fails to forward OTLP HTTP traffic when receiver TLS is enabled. When Tempo Monolithic is configured with `multitenancy.enabled: true` and `ingestion.otlp.http.tls.enabled: true`, the gateway forwards OTLP HTTP traffic to the Tempo receiver using plain HTTP instead of HTTPS. As a consequence, the connection fails with a `connection reset by peer` error because the receiver expects TLS connections. OTLP gRPC ingestion through the gateway is not affected. Jira issue: https://issues.redhat.com/browse/TRACING-5973.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Threats
Impact
Moderate
A flaw was found in the `github.com/antchfx/xpath` component. A remote attacker could exploit this vulnerability by submitting crafted Boolean XPath expressions that evaluate to true. This can cause an infinite loop in the `logicalQuery.Select` function, leading to 100% CPU utilization and a Denial of Service (DoS) condition for the affected system.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Workaround
|
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in github.com/buger/jsonparser. The Delete function, when processing malformed JSON input, fails to properly validate offsets. This vulnerability can lead to a negative slice index and a runtime panic, allowing a remote attacker to cause a denial of service (DoS) by providing specially crafted JSON data.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Vendor Fix
fix
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x | — |
Workaround
|
Threats
Impact
Important
References
92 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift distributed tracing platform (Tempo) 3.9.2 has been released",
"title": "Topic"
},
{
"category": "general",
"text": "This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements and bug fixes.\n\n\nBreaking changes:\n\n* None.\n\n\nDeprecations:\n\n* None.\n\n\nTechnology Preview features:\n\n* None.\n\n\nEnhancements:\n\n* None.\n\n\nBug fixes:\n\n* gRPC-Go authorization bypass vulnerability fix: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 :path pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed :path that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the :path pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186.\n\n* XPath component fix: Previously, the github.com/antchfx/xpath component did not properly handle certain Boolean XPath expressions. A remote attacker could submit a crafted expression that caused an infinite loop, resulting in 100% CPU utilization and a denial-of-service condition. With this update, the XPath component correctly processes Boolean expressions that evaluate to true. The system no longer enters an infinite loop when handling these expressions. For more information, see https://access.redhat.com/security/cve/cve-2026-4645.\n\n* Go JOSE denial-of-service vulnerability fix: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial-of-service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986.\n\n* Lodash _.template function fix: Previously, the lodash _.template function validated the variable option but did not validate options.imports key names. Both options passed values to the same code execution path. An attacker with the ability to control options.imports key names or pollute Object.prototype could exploit this gap to execute arbitrary code. With this update, lodash validates options.imports key names by using the same rules applied to the variable option. The _.template function rejects invalid key names and prevents code injection through this path. For more information, see https://access.redhat.com/security/cve/cve-2026-4800.\n\n* Go crypto/x509 and crypto/tls packages fix: Previously, the Go standard library crypto/x509 and crypto/tls packages did not limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing the system to perform an uncontrolled amount of work and resulting in a denial-of-service condition. With this update, the packages limit the number of intermediate certificates accepted during certificate chain validation. The system rejects certificate chains that exceed this limit. For more information, see https://access.redhat.com/security/cve/cve-2026-32280.\n\n* Go Root.Chmod function fix: Previously, the Root.Chmod function in the Go standard library internal/syscall/unix package had a race condition between checking and modifying a target file. An attacker could replace the target with a symbolic link after the check but before the operation completed, causing the permission change to apply to the linked file instead. This allowed an attacker to bypass directory restrictions and change permissions on unintended files. With this update, the Root.Chmod function prevents this race condition. The function no longer follows symbolic links that replace the target during execution. For more information, see https://access.redhat.com/security/cve/cve-2026-32282.\n\n* Go crypto/x509 package fix: Previously, the Go crypto/x509 package applied excluded DNS constraints to wildcard Subject Alternative Names (SANs) in a case-sensitive manner. An attacker could bypass certificate validation by using a different case in the wildcard SAN than the excluded DNS constraint specified. This allowed the system to accept a malicious certificate that should have been rejected. With this update, the package applies DNS constraints case-insensitively when validating wildcard SANs. Certificate chain verification correctly rejects certificates that match excluded DNS constraints regardless of case. For more information, see https://access.redhat.com/security/cve/cve-2026-33810.\n\n* Go crypto/tls component fix: Previously, the Go crypto/tls component did not re-validate certificates against updated certificate authority (CA) settings during TLS session resumption. If CA settings changed between the initial handshake and a resumed session, the component used the original CA settings. An attacker could exploit this to bypass certificate validation and establish a connection that should have been rejected. With this update, the component validates certificates against the current CA settings during session resumption. Resumed sessions that no longer meet CA requirements are rejected. For more information, see https://access.redhat.com/security/cve/cve-2025-68121.\n\n* jsonparser Delete function fix: Previously, the Delete function in the github.com/buger/jsonparser component did not validate offsets when processing malformed JSON input. A remote attacker could provide crafted JSON data that caused a runtime panic, resulting in a denial-of-service condition. With this update, the Delete function validates offsets before processing. The function handles malformed JSON input as expected. For more information, see https://access.redhat.com/security/cve/cve-2026-32285.\n\n* path-to-regexp component fix: Previously, the path-to-regexp component did not limit the complexity of generated regular expressions. A remote attacker could provide input containing multiple sequential optional groups, causing exponential growth in the generated expression and excessive resource consumption. This resulted in a denial-of-service condition. With this update, the component limits regular expression complexity. Input patterns with sequential optional groups no longer cause excessive resource consumption. For more information, see https://access.redhat.com/security/cve/cve-2026-4926.\n\n* Go net/url.Parse function fix: Previously, the Go net/url.Parse function did not properly validate the host component of URLs containing IP-literals. The function ignored invalid characters preceding IP-literals and accepted URLs that should have been rejected. With this update, the function validates the entire host component. URLs with invalid characters before IP-literals are rejected as malformed. For more information, see https://access.redhat.com/security/cve/cve-2026-25679.\n\n* Go crypto/x509 module fix: Previously, the Go crypto/x509 module did not apply all email address constraints when validating certificates. If a certificate contained multiple email constraints with the same local portion but different domain portions, the module only enforced the last constraint and ignored the others. With this update, the module applies all email address constraints during certificate chain validation. Certificates are validated against every specified email constraint. For more information, see https://access.redhat.com/security/cve/cve-2026-27137.\n\n\nKnown issues:\n\n* Gateway fails to forward OTLP HTTP traffic when receiver TLS is enabled. When Tempo Monolithic is configured with `multitenancy.enabled: true` and `ingestion.otlp.http.tls.enabled: true`, the gateway forwards OTLP HTTP traffic to the Tempo receiver using plain HTTP instead of HTTPS. As a consequence, the connection fails with a `connection reset by peer` error because the receiver expects TLS connections. OTLP gRPC ingestion through the gateway is not affected. Jira issue: https://issues.redhat.com/browse/TRACING-5973.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:9385",
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32285",
"url": "https://access.redhat.com/security/cve/CVE-2026-32285"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33810",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4645",
"url": "https://access.redhat.com/security/cve/CVE-2026-4645"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4926",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9385.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.9.2 release",
"tracking": {
"current_release_date": "2026-07-05T19:29:17+00:00",
"generator": {
"date": "2026-07-05T19:29:17+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:9385",
"initial_release_date": "2026-04-21T15:08:38+00:00",
"revision_history": [
{
"date": "2026-04-21T15:08:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-21T15:08:49+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-05T19:29:17+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift distributed tracing 3.9.3",
"product": {
"name": "Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift distributed tracing"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-operator-bundle@sha256%3Ad180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776674955"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435643"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3A0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435631"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9-operator@sha256%3Aa5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-query-rhel9@sha256%3A1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435613"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9@sha256%3A9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435680"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-rhel9@sha256%3Ac939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435643"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3A81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3Aa66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435631"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9-operator@sha256%3A0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-query-rhel9@sha256%3A3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435613"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9@sha256%3A53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435680"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435643"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3A15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435631"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9-operator@sha256%3A1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-query-rhel9@sha256%3A820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435613"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9@sha256%3A55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435680"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435643"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3A63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3Ab68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435631"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9-operator@sha256%3Ac7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-query-rhel9@sha256%3Aee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435613"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9@sha256%3A0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435680"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-4645",
"discovery_date": "2026-03-23T06:02:52.120840+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `github.com/antchfx/xpath` component. A remote attacker could exploit this vulnerability by submitting crafted Boolean XPath expressions that evaluate to true. This can cause an infinite loop in the `logicalQuery.Select` function, leading to 100% CPU utilization and a Denial of Service (DoS) condition for the affected system.",
"title": "Vulnerability description"
},
{
"category": "other",
"text": "A denial of service vulnerability was discovered in `github.com/antchfx/xpath`, with Important severity. Systems processing untrusted XPath expressions are vulnerable to an infinite loop, leading to 100% CPU utilization which would impact normal operations of the system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4645"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4645",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4645"
}
],
"release_date": "2026-03-17T20:58:59+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the processing of untrusted or unvalidated XPath expressions by applications which utilize the `github.com/antchfx/xpath` component. Implement input validation and sanitization for all XPath expressions originating from external or untrusted sources. If possible, configure applications to only process XPath expressions from trusted sources or disable features that allow arbitrary XPath expression evaluation.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/antchfx/xpath: xpath: Denial of Service via crafted Boolean XPath expressions"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-4926",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-03-26T20:03:28.427630+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in `path-to-regexp` that can lead to a Denial of Service. The vulnerability occurs when specially crafted input containing multiple sequential optional groups is used to generate regular expressions, causing exponential resource consumption.\n\nThe Red Hat Advanced Cluster Security is not affected by this issue since it\u0027s shipping a `path-to-regexp` version which doesn\u0027t contain the vulnerable code.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "RHBZ#2451867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4926"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"release_date": "2026-03-26T18:59:38+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32285",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:54.925687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451846"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/buger/jsonparser. The Delete function, when processing malformed JSON input, fails to properly validate offsets. This vulnerability can lead to a negative slice index and a runtime panic, allowing a remote attacker to cause a denial of service (DoS) by providing specially crafted JSON data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32285"
},
{
"category": "external",
"summary": "RHBZ#2451846",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451846"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32285"
},
{
"category": "external",
"summary": "https://github.com/buger/jsonparser/issues/275",
"url": "https://github.com/buger/jsonparser/issues/275"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4514",
"url": "https://github.com/golang/vulndb/issues/4514"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4514",
"url": "https://pkg.go.dev/vuln/GO-2026-4514"
}
],
"release_date": "2026-03-26T19:40:51.837000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:9388
Vulnerability from csaf_redhat - Published: 2026-04-21 15:19 - Updated: 2026-07-05 19:29Summary
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.2 release
Severity
Important
Notes
Topic: Red Hat build of OpenTelemetry 3.9.2 has been released
Details: This release of the Red Hat build of OpenTelemetry provides security improvements.
Breaking changes:
* None
Deprecations:
* None
Technology Preview features:
* None
Enhancements:
* None
Bug fixes:
* XPath library vulnerability is fixed: Previously, the 'github.com/antchfx/xpath' library was vulnerable to a denial of service (DoS) attack. This issue occurred because specially crafted boolean XPath expressions that evaluated to true caused an infinite loop in the 'logicalQuery.Select' function, leading to 100% CPU utilization. With this update, the XPath library properly handles these expressions and prevents infinite loops. As a result, the system is no longer vulnerable to this DoS condition. For more information, see https://access.redhat.com/security/cve/cve-2026-32287.
* gRPC-Go authorization bypass vulnerability is fixed: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 ':path' pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed ':path' that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the ':path' pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186.
* Go JOSE denial of service vulnerability is fixed: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial of service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986.
Known issues:
* The filesystem scraper does not produce the `system.filesystem.inodes.usage` and `system.filesystem.usage` metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in github.com/antchfx/xpath. An attacker could exploit this vulnerability by providing specially crafted boolean XPath expressions that evaluate to true. This can cause an infinite loop within the logicalQuery.Select function, leading to 100% CPU utilization. The consequence is a Denial of Service (DoS) condition, making the affected system unresponsive.
6.2 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64 | — |
Vendor Fix
fix
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x | — |
Threats
Impact
Moderate
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x | — |
Workaround
|
Threats
Impact
Important
References
26 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat build of OpenTelemetry 3.9.2 has been released",
"title": "Topic"
},
{
"category": "general",
"text": "This release of the Red Hat build of OpenTelemetry provides security improvements.\n\n\nBreaking changes:\n\n* None\n\n\nDeprecations:\n\n* None\n\n\nTechnology Preview features:\n\n* None\n\n\nEnhancements:\n\n* None\n\n\nBug fixes:\n\n* XPath library vulnerability is fixed: Previously, the \u0027github.com/antchfx/xpath\u0027 library was vulnerable to a denial of service (DoS) attack. This issue occurred because specially crafted boolean XPath expressions that evaluated to true caused an infinite loop in the \u0027logicalQuery.Select\u0027 function, leading to 100% CPU utilization. With this update, the XPath library properly handles these expressions and prevents infinite loops. As a result, the system is no longer vulnerable to this DoS condition. For more information, see https://access.redhat.com/security/cve/cve-2026-32287.\n\n* gRPC-Go authorization bypass vulnerability is fixed: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 \u0027:path\u0027 pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed \u0027:path\u0027 that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the \u0027:path\u0027 pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186.\n\n* Go JOSE denial of service vulnerability is fixed: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial of service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986.\n\n\nKnown issues:\n\n* The filesystem scraper does not produce the `system.filesystem.inodes.usage` and `system.filesystem.usage` metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:9388",
"url": "https://access.redhat.com/errata/RHSA-2026:9388"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32287",
"url": "https://access.redhat.com/security/cve/CVE-2026-32287"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9388.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.2 release",
"tracking": {
"current_release_date": "2026-07-05T19:29:17+00:00",
"generator": {
"date": "2026-07-05T19:29:17+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:9388",
"initial_release_date": "2026-04-21T15:19:05+00:00",
"revision_history": [
{
"date": "2026-04-21T15:19:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-21T15:19:07+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-05T19:29:17+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift distributed tracing 3.9.3",
"product": {
"name": "Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift distributed tracing"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-operator-bundle@sha256%3A333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776245088"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185379"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185352"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Abcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185328"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3Aff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185379"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185352"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3A28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185328"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185379"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185352"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3A9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185328"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185379"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185352"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Aca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776185328"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32287",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-03-26T20:02:37.779428+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451856"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/antchfx/xpath. An attacker could exploit this vulnerability by providing specially crafted boolean XPath expressions that evaluate to true. This can cause an infinite loop within the logicalQuery.Select function, leading to 100% CPU utilization. The consequence is a Denial of Service (DoS) condition, making the affected system unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/antchfx/xpath: github.com/antchfx/xpath: Denial of Service due to infinite loop via boolean XPath expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32287"
},
{
"category": "external",
"summary": "RHBZ#2451856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32287"
},
{
"category": "external",
"summary": "https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494",
"url": "https://github.com/antchfx/xpath/commit/afd4762cc342af56345a3fb4002a59281fcab494"
},
{
"category": "external",
"summary": "https://github.com/antchfx/xpath/issues/121",
"url": "https://github.com/antchfx/xpath/issues/121"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4526",
"url": "https://github.com/golang/vulndb/issues/4526"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4526",
"url": "https://pkg.go.dev/vuln/GO-2026-4526"
}
],
"release_date": "2026-03-26T19:40:52.142000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:19:05+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9388"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/antchfx/xpath: github.com/antchfx/xpath: Denial of Service due to infinite loop via boolean XPath expressions"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:19:05+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9388"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:19:05+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9388"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:9440
Vulnerability from csaf_redhat - Published: 2026-04-21 17:12 - Updated: 2026-07-05 19:29Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.10
Severity
Important
Notes
Topic: Red Hat OpenShift Service Mesh 3.0.10
This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Service Mesh 3.0.10, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.
Fixes/Improvements:
Security Fix(es):
* istio-rhel9-operator: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-cni-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-pilot-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-proxyv2-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-proxyv2-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
* istio-proxyv2-rhel9: BuildKit: Arbitrary file write and code execution via untrusted frontend (CVE-2026-33747)
* istio-proxyv2-rhel9: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64 | — |
Workaround
|
Threats
Impact
Moderate
References
37 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Service Mesh 3.0.10\n\nThis update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Service Mesh 3.0.10, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.\n\nFixes/Improvements:\n\nSecurity Fix(es):\n\n* istio-rhel9-operator: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-cni-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-pilot-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-proxyv2-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-proxyv2-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* istio-proxyv2-rhel9: BuildKit: Arbitrary file write and code execution via untrusted frontend (CVE-2026-33747)\n\n* istio-proxyv2-rhel9: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:9440",
"url": "https://access.redhat.com/errata/RHSA-2026:9440"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33747",
"url": "https://access.redhat.com/security/cve/CVE-2026-33747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33748",
"url": "https://access.redhat.com/security/cve/CVE-2026-33748"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-25679",
"url": "https://access.redhat.com/security/cve/cve-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-33186",
"url": "https://access.redhat.com/security/cve/cve-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-33747",
"url": "https://access.redhat.com/security/cve/cve-2026-33747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-33748",
"url": "https://access.redhat.com/security/cve/cve-2026-33748"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9440.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.10",
"tracking": {
"current_release_date": "2026-07-05T19:29:18+00:00",
"generator": {
"date": "2026-07-05T19:29:18+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:9440",
"initial_release_date": "2026-04-21T17:12:20+00:00",
"revision_history": [
{
"date": "2026-04-21T17:12:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-21T17:12:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-05T19:29:18+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.0",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.0::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-sail-operator-bundle@sha256%3Ac09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776442219"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3Abf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181080"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181079"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3A5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776180733"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3Ab00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181166"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776240392"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh-dev-preview-beta\u0026tag=1776181708"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181080"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181079"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3Ab4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776180733"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3A66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181166"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3Aa2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776240392"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh-dev-preview-beta\u0026tag=1776181708"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181080"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181079"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3Aaea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776180733"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3Ae86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181166"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3Ae33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776240392"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh-dev-preview-beta\u0026tag=1776181708"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181080"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181079"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3Ad37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776180733"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3Ab383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776181166"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776240392"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh-dev-preview-beta\u0026tag=1776181708"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
"product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:12:20+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.0.10 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:12:20+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.0.10 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9440"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33747",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-27T02:01:29.921765+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452076"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33747"
},
{
"category": "external",
"summary": "RHBZ#2452076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33747"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1",
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj"
}
],
"release_date": "2026-03-27T00:49:06.165000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:12:20+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.0.10 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9440"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend"
},
{
"cve": "CVE-2026-33748",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-27T15:02:00.107493+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452271"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33748"
},
{
"category": "external",
"summary": "RHBZ#2452271",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452271"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33748"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748"
},
{
"category": "external",
"summary": "https://docs.docker.com/build/concepts/context/#url-fragments",
"url": "https://docs.docker.com/build/concepts/context/#url-fragments"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1",
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg"
}
],
"release_date": "2026-03-27T14:00:21.200000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:12:20+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.0.10 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9440"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3c8a43dac72fcb80665579849150ce601046fbcf6c2306583b0490605115ac0f_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:693b5c635be68ad83f43140b36603d99a20c879bf345d12a44890b45bcd07b01_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:734219183920ce01e754291dd7611715a69a9403f9633b3400755786fcc275cd_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:8cbf69617323c8c5a34eb52591608ec28f43de129ed6140baf3f9a9a7fa483f8_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1fd5ff140d8d559cfd3c5ba85036579e0e72fa4ce7125e16c1ea24d70e94ff86_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:46e186d49081b64a4291e49e5f2acd77184699b66cdc08acdbb7e82c259b2b74_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:86787f164505d6ef3917997ad7a424d65da313fe50f0f952f13f55ce9d798b99_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:bf1d68837cdb05f9c95e3c42692cc9e83fd4a0c5ac3dc7da3ffae49626502a9c_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2a6694107707703209034473f159ab1f7e22106c7d1e1d722f373627dd9d7c47_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5faebff2c06c92bbff9453f577c9b6c259e5365fb4f452f630c592e7a06673a2_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8bec8dff7483dcb749deca1d7df6042b94d2a84abed4cf82e69230a8c28c59ca_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9fa72261b4c4a178430ab10cecb79e1c9599740c3fc06192014245b1db1edffc_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66d3a47929e31772f8cde153eb0523fb0f1696547ab2dbe98b30a453306b8adc_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b00869deda7269236cb315b95c8abf4930b97995dcac9212a99b561251a401a9_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b383628612ef6aff4328bd880b2400fd4011b53a1429a2ffacfc4d15f515d634_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e86ddb9ffc3b50dc508f5eae310bcf1e7c994e7dbe3d538baebc1dc41316722d_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3113f8ef93a2abecad7ad6bd44d800c9c2735888b93f7a9b713ee93669fc3802_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5f9b2a458158fbf02a611d8d2822c6425d186ce4cd73c091a097a3c0218f18ff_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2650c47f50206054063e8a62a8073d29a29808b21c2ab3d9964bd70995ff6eb_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e33cee7e3c778713dd44e3109609155061de98b83fbb91a89182179163ec05d4_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5931cffa333330d80fa57431080621e8f39cdb9257201fad7d56da31b01c569f_amd64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:aea2066308c02465b7d1edc6afd52d3b6c37a92d1ca38e929a7354be2bb36493_ppc64le",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b4339c9932dc7d84ce95f6b84a70f428f5f8da03e607f19602da5f83b6cacf1b_arm64",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d37b966d871535c9277cda4c8aef1d9306b4f47f38043718ab4f13ccebbebc6b_s390x",
"Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:c09e38353c9125431890b9cbd0be760b8b6c3d1faf6bb515e20c2c414dd70f2d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components"
}
]
}
RHSA-2026:9448
Vulnerability from csaf_redhat - Published: 2026-04-21 17:23 - Updated: 2026-07-05 19:29Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.7
Severity
Important
Notes
Topic: Red Hat OpenShift Service Mesh 3.1.7
This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Service Mesh 3.1.7, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.
Fixes/Improvements:
Security Fix(es):
* istio-rhel9-operator: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-cni-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-pilot-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-proxyv2-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-proxyv2-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
* istio-proxyv2-rhel9: BuildKit: Arbitrary file write and code execution via untrusted frontend (CVE-2026-33747)
* istio-proxyv2-rhel9: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748)
* istio-cni-rhel9: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
* istio-pilot-rhel9: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
Bug Fix(es):
* OSSM operator metrics reader ClusterRole conflicts with other operators (OSSM-13106)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64 | — |
Workaround
|
Threats
Impact
Important
References
45 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Service Mesh 3.1.7\n\nThis update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Service Mesh 3.1.7, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.\n\nFixes/Improvements:\n\nSecurity Fix(es):\n\n* istio-rhel9-operator: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-cni-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-pilot-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-proxyv2-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-proxyv2-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* istio-proxyv2-rhel9: BuildKit: Arbitrary file write and code execution via untrusted frontend (CVE-2026-33747)\n\n* istio-proxyv2-rhel9: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748)\n\n* istio-cni-rhel9: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* istio-pilot-rhel9: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\nBug Fix(es):\n\n* OSSM operator metrics reader ClusterRole conflicts with other operators (OSSM-13106)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:9448",
"url": "https://access.redhat.com/errata/RHSA-2026:9448"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33747",
"url": "https://access.redhat.com/security/cve/CVE-2026-33747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33748",
"url": "https://access.redhat.com/security/cve/CVE-2026-33748"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-25679",
"url": "https://access.redhat.com/security/cve/cve-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-33186",
"url": "https://access.redhat.com/security/cve/cve-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-33747",
"url": "https://access.redhat.com/security/cve/cve-2026-33747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-33748",
"url": "https://access.redhat.com/security/cve/cve-2026-33748"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-34986",
"url": "https://access.redhat.com/security/cve/cve-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9448.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.7",
"tracking": {
"current_release_date": "2026-07-05T19:29:18+00:00",
"generator": {
"date": "2026-07-05T19:29:18+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:9448",
"initial_release_date": "2026-04-21T17:23:46+00:00",
"revision_history": [
{
"date": "2026-04-21T17:23:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-21T17:23:52+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-05T19:29:18+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.1",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.1::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-sail-operator-bundle@sha256%3A2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776677125"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776238635"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776412783"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3A149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232570"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3Ae496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776256858"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776315466"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh-tech-preview\u0026tag=1776177800"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776238635"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776412783"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3Abfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232570"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3A7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776256858"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776315466"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh-tech-preview\u0026tag=1776177800"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776238635"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776412783"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3A8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232570"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3Aa55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776256858"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776315466"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh-tech-preview\u0026tag=1776177800"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776238635"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776412783"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3A2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232570"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3A702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776256858"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776315466"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh-tech-preview\u0026tag=1776177800"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64 as a component of Red Hat OpenShift Service Mesh 3.1",
"product_id": "Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:23:46+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.1.7 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9448"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:23:46+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.1.7 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9448"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33747",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-27T02:01:29.921765+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452076"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33747"
},
{
"category": "external",
"summary": "RHBZ#2452076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33747"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1",
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj"
}
],
"release_date": "2026-03-27T00:49:06.165000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:23:46+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.1.7 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9448"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend"
},
{
"cve": "CVE-2026-33748",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-27T15:02:00.107493+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452271"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33748"
},
{
"category": "external",
"summary": "RHBZ#2452271",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452271"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33748"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748"
},
{
"category": "external",
"summary": "https://docs.docker.com/build/concepts/context/#url-fragments",
"url": "https://docs.docker.com/build/concepts/context/#url-fragments"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1",
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg"
}
],
"release_date": "2026-03-27T14:00:21.200000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:23:46+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.1.7 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9448"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:23:46+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.1.7 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9448"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64",
"Red Hat OpenShift Service Mesh 3.1:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:9453
Vulnerability from csaf_redhat - Published: 2026-04-21 17:29 - Updated: 2026-07-05 19:29Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.4
Severity
Important
Notes
Topic: Red Hat OpenShift Service Mesh 3.2.4
This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Service Mesh 3.2.4, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.
Fixes/Improvements:
Security Fix(es):
* istio-rhel9-operator: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-cni-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-pilot-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-proxyv2-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* istio-proxyv2-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
* istio-proxyv2-rhel9: BuildKit: Arbitrary file write and code execution via untrusted frontend (CVE-2026-33747)
* istio-proxyv2-rhel9: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748)
* istio-cni-rhel9: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
* istio-pilot-rhel9: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
Bug Fix(es):
* Ztunnel default value in operator contains older istio version (OSSM-13103)
* OSSM operator metrics reader ClusterRole conflicts with other operators (OSSM-13106)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64 | — |
Workaround
|
Threats
Impact
Important
References
45 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Service Mesh 3.2.4\n\nThis update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Service Mesh 3.2.4, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.\n\nFixes/Improvements:\n\nSecurity Fix(es):\n\n* istio-rhel9-operator: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-cni-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-pilot-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-proxyv2-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* istio-proxyv2-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* istio-proxyv2-rhel9: BuildKit: Arbitrary file write and code execution via untrusted frontend (CVE-2026-33747)\n\n* istio-proxyv2-rhel9: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748)\n\n* istio-cni-rhel9: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* istio-pilot-rhel9: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\nBug Fix(es):\n\n* Ztunnel default value in operator contains older istio version (OSSM-13103)\n\n* OSSM operator metrics reader ClusterRole conflicts with other operators (OSSM-13106)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:9453",
"url": "https://access.redhat.com/errata/RHSA-2026:9453"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33747",
"url": "https://access.redhat.com/security/cve/CVE-2026-33747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33748",
"url": "https://access.redhat.com/security/cve/CVE-2026-33748"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-25679",
"url": "https://access.redhat.com/security/cve/cve-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-33186",
"url": "https://access.redhat.com/security/cve/cve-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-33747",
"url": "https://access.redhat.com/security/cve/cve-2026-33747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-33748",
"url": "https://access.redhat.com/security/cve/cve-2026-33748"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-34986",
"url": "https://access.redhat.com/security/cve/cve-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9453.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.4",
"tracking": {
"current_release_date": "2026-07-05T19:29:18+00:00",
"generator": {
"date": "2026-07-05T19:29:18+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:9453",
"initial_release_date": "2026-04-21T17:29:36+00:00",
"revision_history": [
{
"date": "2026-04-21T17:29:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-21T17:29:40+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-05T19:29:18+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.2",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-sail-operator-bundle@sha256%3A615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776677282"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776178280"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776238602"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3A87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232405"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3A31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776178059"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3Af62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776291540"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3Acf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232170"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776178280"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776238602"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3Adfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232405"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3A193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776178059"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776291540"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232170"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776178280"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776238602"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3A6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232405"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3A7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776178059"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776291540"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232170"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-cni-rhel9@sha256%3A1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776178280"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-must-gather-rhel9@sha256%3Ac592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776238602"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-rhel9-operator@sha256%3A3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232405"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-pilot-rhel9@sha256%3A8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776178059"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3Aa2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776291540"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776232170"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:29:36+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.2.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9453"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:29:36+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.2.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9453"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33747",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-27T02:01:29.921765+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452076"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33747"
},
{
"category": "external",
"summary": "RHBZ#2452076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33747"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1",
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj"
}
],
"release_date": "2026-03-27T00:49:06.165000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:29:36+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.2.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9453"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend"
},
{
"cve": "CVE-2026-33748",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-27T15:02:00.107493+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452271"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33748"
},
{
"category": "external",
"summary": "RHBZ#2452271",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452271"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33748"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748"
},
{
"category": "external",
"summary": "https://docs.docker.com/build/concepts/context/#url-fragments",
"url": "https://docs.docker.com/build/concepts/context/#url-fragments"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1",
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg"
}
],
"release_date": "2026-03-27T14:00:21.200000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:29:36+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.2.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9453"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T17:29:36+00:00",
"details": "See Red Hat OpenShift Service Mesh 3.2.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9453"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1aa2834ce676ef21f5a67e3144fe62677d9bf7b57a9401d74fab7cf569da9911_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4d39ae3b09ef2ee139705831bff3f9070d2590d59887a488bfdbb36b590dec13_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4f5e7e28f111429e2c9376ac5f42d717f13eea1c3a80357fe001a9caf5c25fba_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:727908a49c6edf57609ac8a75d5aab182a79530e88819ea8a1df8a9610826c02_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:284458d236e45ffa8a865917bf6253764dbe0f6602173ba3f6733b0a40c5a741_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2b6f5aa276fe5848c6f377c51be574045b04ea784374bcb54e496f2a297f02b0_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5b95c5cfc63958a16f3b30a42f16b9ff26b2f2c9f8e3c539fcec75b721edfb88_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c592a7d2b6b5997972ed7a2deda29c5e9bb03c2b28e42d1f6f57ae1639629c11_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:193b36cc5bc389b68c6e8080e1d47c3860aab22f7a4ee262c90b864967e23a97_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:31e020f606b687b82712fe32823a392ed1abcc9563845ea81fbfce616b99e6b1_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7e688abcea40cae3f552b2dc5abf0da092e8a0d7a3f04f3cb5d15c5b4fb1a1f2_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8111afc971379ee93fef9ebddfccf75102309c134d25f9d6d3de46f59e809001_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3e210dcd0cab9c18bc0629a3a20b27e75bc09c09decbfcc9f6ab69f7c29670e1_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d1e9ff2ab9a3f84328cdbe49d4263d34e9ef1ef14d689a32d87534d7631cb0d_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a2904680a45ff398adce27c1cbc539bf08e7f53aa64fadf0d6db74f1296421ad_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:f62ae2005f3c153975695253d786a00a1a5827b92f96328a0be425fdd4125e69_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f1d2206dea7630015fac80f8b8c6f7a6a1e1c17e477d1d54db4690b4453e6a0_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6015e887371eed1bd162363ebd16ca4f20bd8077df166b455685579e808a9292_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:87953048140227569e7028187ed92cc0960bbc055d62a6755c5a1fdcf10510ec_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dfb94112b66ce7fe56a642371749bf87e979b0136652328b124cc384818ef6c3_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:615f4ab167e82d54f5cd9bea15e0673293ec42bf19cfa0ccc15eb1d20b7db18a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:56140955dffe7c205dc944835637f83f04c5a82ba6f192dcfb034aa9cf800f8f_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:62b18afbdedf572866fd0dca6aa9e2426608d0b1cf011acef9f9044f4fbe4711_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:74b244e23b80d7996138a01814de1cb9d679ce7ed4156b5521fd76efc1bb5db5_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:cf5b5c9c6ba78281d0080d426f71c5b7b3e2b46db3644d153862268c0b4bf538_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:9872
Vulnerability from csaf_redhat - Published: 2026-04-22 21:03 - Updated: 2026-07-05 19:29Summary
Red Hat Security Advisory: DevWorkspace Operator 0.40.1 release.
Severity
Important
Notes
Topic: DevWorkspace Operator 0.40.1 has been released.
Details: The DevWorkspace Operator extends OpenShift to provide DevWorkspace support.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x | — |
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64 | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x | — |
Workaround
|
|
| Unresolved product id: DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64 | — |
Workaround
|
Threats
Impact
Important
References
27 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "DevWorkspace Operator 0.40.1 has been released.",
"title": "Topic"
},
{
"category": "general",
"text": "The DevWorkspace Operator extends OpenShift to provide DevWorkspace support.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:9872",
"url": "https://access.redhat.com/errata/RHSA-2026:9872"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://redhat.atlassian.net/browse/CRW-10592",
"url": "https://redhat.atlassian.net/browse/CRW-10592"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9872.json"
}
],
"title": "Red Hat Security Advisory: DevWorkspace Operator 0.40.1 release.",
"tracking": {
"current_release_date": "2026-07-05T19:29:18+00:00",
"generator": {
"date": "2026-07-05T19:29:18+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.1"
}
},
"id": "RHSA-2026:9872",
"initial_release_date": "2026-04-22T21:03:38+00:00",
"revision_history": [
{
"date": "2026-04-22T21:03:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-22T21:03:45+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-05T19:29:18+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "DevWorkspace Operator 0.4",
"product": {
"name": "DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:devworkspace:0.40::el9"
}
}
}
],
"category": "product_family",
"name": "DevWorkspace Operator"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"product_id": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-rhel9-operator@sha256%3A9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457293"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"product_id": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-operator-bundle@sha256%3A991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776559999"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"product_id": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-project-backup-rhel9@sha256%3A798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776462971"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"product_id": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-project-clone-rhel9@sha256%3A105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750?arch=amd64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457327"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"product_id": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-rhel9-operator@sha256%3A78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca?arch=s390x\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457293"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"product_id": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-project-backup-rhel9@sha256%3A992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962?arch=s390x\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776462971"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"product_id": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-project-clone-rhel9@sha256%3Ae14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34?arch=s390x\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457327"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"product_id": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-rhel9-operator@sha256%3A7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8?arch=ppc64le\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457293"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"product_id": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-project-backup-rhel9@sha256%3A0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b?arch=ppc64le\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776462971"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"product_id": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-project-clone-rhel9@sha256%3A03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d?arch=ppc64le\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457327"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64",
"product_id": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-rhel9-operator@sha256%3Aa55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2?arch=arm64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457293"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"product_id": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-project-backup-rhel9@sha256%3A9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09?arch=arm64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776462971"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"product": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"product_id": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"product_identification_helper": {
"purl": "pkg:oci/devworkspace-project-clone-rhel9@sha256%3A053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596?arch=arm64\u0026repository_url=registry.redhat.io/devworkspace\u0026tag=1776457327"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64 as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64 as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64 as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64 as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64 as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64 as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64 as a component of DevWorkspace Operator 0.4",
"product_id": "DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
},
"product_reference": "registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64",
"relates_to_product_reference": "DevWorkspace Operator 0.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
],
"known_not_affected": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T21:03:38+00:00",
"details": "To start using the DevWorkspace Operator, install the DevWorkspace Operator from OpenShift OperatorHub on OpenShift Container Platform 4.16 or higher.",
"product_ids": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9872"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
],
"known_not_affected": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T21:03:38+00:00",
"details": "To start using the DevWorkspace Operator, install the DevWorkspace Operator from OpenShift OperatorHub on OpenShift Container Platform 4.16 or higher.",
"product_ids": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9872"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
],
"known_not_affected": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-22T21:03:38+00:00",
"details": "To start using the DevWorkspace Operator, install the DevWorkspace Operator from OpenShift OperatorHub on OpenShift Container Platform 4.16 or higher.",
"product_ids": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9872"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:991f3f31d41dc78e4aede374e9d6eaf82016da4528c3481af9936b4ab5ed30ca_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0131e2bce3611a145b67ead5e4e0c0bb4206a996211510daffe7f0eeef42992b_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:798b5bfebc9c5423a116c80732fa5e1dd01dc0b99795387bc81b95c98ffc42a6_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:992b3afbd4630383951536fad36590328f5f4dd1ac438b24860e307bb21f6962_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:9fe2f1443f73cc296a9f50aba782c5b6aabae4a2adbba754f4346a395bd8bc09_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:03e66dbde56c09f627bc5eb60ebfd5127a43d313dff99e75e37039de8ab9430d_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:053d1f1ba2f47f45379e4630d3cdcb734915e538f2500477108e2fb9f28b0596_arm64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:105988d31561736be604af59fa46b7b73003609546cf9b8bf5af97112c4dc750_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:e14baa9938a2ce79f2f977e70c6a706620e7eb652191269b628f6164f4120f34_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:7033e308ba08300838ce7b507434d3e2bed97e0b8919409079b5c9705cbf06e8_ppc64le",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:78b5652108b78dc1b8b3e5bd10026ec02954c41a73c59857ef8a75b2a59d3eca_s390x",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:9b0eea627cc3a2531a517df168818f40c92ebbf0a22ab56a22396600a2e59d04_amd64",
"DevWorkspace Operator 0.4:registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:a55f5c74e35c5fe7dbab7b6e1cd6ea824606ed8d198e903dad264baab40008e2_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
}
]
}
SUSE-SU-2026:1194-1
Vulnerability from csaf_suse - Published: 2026-04-07 09:25 - Updated: 2026-04-07 09:25Summary
Security update for google-cloud-sap-agent
Severity
Important
Notes
Title of the patch: Security update for google-cloud-sap-agent
Description of the patch: This update for google-cloud-sap-agent fixes the following issue:
Update to google-cloud-sap-agent 3.12 (bsc#1259816):
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-
header (bsc#1260265).
Changelog:
* Collect WLM metric `saphanasr_angi_installed` for all OS types.
* Failure handling: Remove attached disks from CG
* OTE Status checks for Parameter Manager (SAP Agent)
* Log command-line arguments in configureinstance.
* Minor multiple reliability checks and fixes
* Support custom names for restored disks in hanadiskrestore
* Add newAttachedDisks to Restorer and detach them on restore failure.
* Improve unit test coverage for hanadiskbackup and hanadiskrestore
* Add support for refresh point tests.
* Refactor HANA disk backup user validation and physical path parsing.
* Auto updated compiled protocol buffers
* Parameter Manager integration to SAP Agent
* Modify collection logic for SAP HANA configuration files.
* Update workloadagentplatform version and hash.
* Update WLM Validation metrics to support SAPHanaSR-angi setups.
* Increment agent version to 3.12.
* SAP HANA Pacemaker failover settings can come from `SAPHanaController`.
* Update collection for WLM metric `ha_sr_hook_configured`.
* Refactor CheckTopology to accept instance number.
* Use constant backoff with max retries for snapshot group operations.
* Update workloadagentplatform dependency
Patchnames: SUSE-2026-1194,SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1194,SUSE-SLE-Module-Public-Cloud-15-SP5-2026-1194,SUSE-SLE-Module-Public-Cloud-15-SP6-2026-1194,SUSE-SLE-Module-Public-Cloud-15-SP7-2026-1194,openSUSE-SLE-15.6-2026-1194
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.1 (High)
Affected products
Recommended
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-cloud-sap-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-cloud-sap-agent fixes the following issue:\n\nUpdate to google-cloud-sap-agent 3.12 (bsc#1259816):\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n header (bsc#1260265).\n\nChangelog:\n\n * Collect WLM metric `saphanasr_angi_installed` for all OS types.\n * Failure handling: Remove attached disks from CG\n * OTE Status checks for Parameter Manager (SAP Agent)\n * Log command-line arguments in configureinstance.\n * Minor multiple reliability checks and fixes\n * Support custom names for restored disks in hanadiskrestore\n * Add newAttachedDisks to Restorer and detach them on restore failure.\n * Improve unit test coverage for hanadiskbackup and hanadiskrestore\n * Add support for refresh point tests.\n * Refactor HANA disk backup user validation and physical path parsing.\n * Auto updated compiled protocol buffers\n * Parameter Manager integration to SAP Agent\n * Modify collection logic for SAP HANA configuration files.\n * Update workloadagentplatform version and hash.\n * Update WLM Validation metrics to support SAPHanaSR-angi setups.\n * Increment agent version to 3.12.\n * SAP HANA Pacemaker failover settings can come from `SAPHanaController`.\n * Update collection for WLM metric `ha_sr_hook_configured`.\n * Refactor CheckTopology to accept instance number.\n * Use constant backoff with max retries for snapshot group operations.\n * Update workloadagentplatform dependency\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1194,SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1194,SUSE-SLE-Module-Public-Cloud-15-SP5-2026-1194,SUSE-SLE-Module-Public-Cloud-15-SP6-2026-1194,SUSE-SLE-Module-Public-Cloud-15-SP7-2026-1194,openSUSE-SLE-15.6-2026-1194",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1194-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1194-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261194-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1194-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045295.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259816",
"url": "https://bugzilla.suse.com/1259816"
},
{
"category": "self",
"summary": "SUSE Bug 1260265",
"url": "https://bugzilla.suse.com/1260265"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
}
],
"title": "Security update for google-cloud-sap-agent",
"tracking": {
"current_release_date": "2026-04-07T09:25:07Z",
"generator": {
"date": "2026-04-07T09:25:07Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1194-1",
"initial_release_date": "2026-04-07T09:25:07Z",
"revision_history": [
{
"date": "2026-04-07T09:25:07Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"product": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"product_id": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.i586",
"product": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.i586",
"product_id": "google-cloud-sap-agent-3.12-150100.3.63.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"product": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"product_id": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"product": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"product_id": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"product": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"product_id": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp7"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.s390x"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.s390x"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.s390x"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.s390x"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.s390x"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64"
},
"product_reference": "google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP7:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.aarch64",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.ppc64le",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.s390x",
"openSUSE Leap 15.6:google-cloud-sap-agent-3.12-150100.3.63.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-07T09:25:07Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
}
]
}
SUSE-SU-2026:1195-1
Vulnerability from csaf_suse - Published: 2026-04-07 09:25 - Updated: 2026-04-07 09:25Summary
Security update for google-cloud-sap-agent
Severity
Important
Notes
Title of the patch: Security update for google-cloud-sap-agent
Description of the patch: This update for google-cloud-sap-agent fixes the following issue:
Update to google-cloud-sap-agent 3.12 (bsc#1259816):
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-
header (bsc#1260265).
Changelog:
* Collect WLM metric `saphanasr_angi_installed` for all OS types.
* Failure handling: Remove attached disks from CG
* OTE Status checks for Parameter Manager (SAP Agent)
* Log command-line arguments in configureinstance.
* Minor multiple reliability checks and fixes
* Support custom names for restored disks in hanadiskrestore
* Add newAttachedDisks to Restorer and detach them on restore failure.
* Improve unit test coverage for hanadiskbackup and hanadiskrestore
* Add support for refresh point tests.
* Refactor HANA disk backup user validation and physical path parsing.
* Auto updated compiled protocol buffers
* Parameter Manager integration to SAP Agent
* Modify collection logic for SAP HANA configuration files.
* Update workloadagentplatform version and hash.
* Update WLM Validation metrics to support SAPHanaSR-angi setups.
* Increment agent version to 3.12.
* SAP HANA Pacemaker failover settings can come from `SAPHanaController`.
* Update collection for WLM metric `ha_sr_hook_configured`.
* Refactor CheckTopology to accept instance number.
* Use constant backoff with max retries for snapshot group operations.
* Update workloadagentplatform dependency
Patchnames: SUSE-2026-1195,SUSE-SLE-Module-Public-Cloud-12-2026-1195
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-cloud-sap-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-cloud-sap-agent fixes the following issue:\n\nUpdate to google-cloud-sap-agent 3.12 (bsc#1259816):\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n header (bsc#1260265).\n\nChangelog:\n\n * Collect WLM metric `saphanasr_angi_installed` for all OS types.\n * Failure handling: Remove attached disks from CG\n * OTE Status checks for Parameter Manager (SAP Agent)\n * Log command-line arguments in configureinstance.\n * Minor multiple reliability checks and fixes\n * Support custom names for restored disks in hanadiskrestore\n * Add newAttachedDisks to Restorer and detach them on restore failure.\n * Improve unit test coverage for hanadiskbackup and hanadiskrestore\n * Add support for refresh point tests.\n * Refactor HANA disk backup user validation and physical path parsing.\n * Auto updated compiled protocol buffers\n * Parameter Manager integration to SAP Agent\n * Modify collection logic for SAP HANA configuration files.\n * Update workloadagentplatform version and hash.\n * Update WLM Validation metrics to support SAPHanaSR-angi setups.\n * Increment agent version to 3.12.\n * SAP HANA Pacemaker failover settings can come from `SAPHanaController`.\n * Update collection for WLM metric `ha_sr_hook_configured`.\n * Refactor CheckTopology to accept instance number.\n * Use constant backoff with max retries for snapshot group operations.\n * Update workloadagentplatform dependency\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1195,SUSE-SLE-Module-Public-Cloud-12-2026-1195",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1195-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1195-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261195-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1195-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045294.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259816",
"url": "https://bugzilla.suse.com/1259816"
},
{
"category": "self",
"summary": "SUSE Bug 1260265",
"url": "https://bugzilla.suse.com/1260265"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
}
],
"title": "Security update for google-cloud-sap-agent",
"tracking": {
"current_release_date": "2026-04-07T09:25:22Z",
"generator": {
"date": "2026-04-07T09:25:22Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1195-1",
"initial_release_date": "2026-04-07T09:25:22Z",
"revision_history": [
{
"date": "2026-04-07T09:25:22Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-cloud-sap-agent-3.12-6.60.1.aarch64",
"product": {
"name": "google-cloud-sap-agent-3.12-6.60.1.aarch64",
"product_id": "google-cloud-sap-agent-3.12-6.60.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-cloud-sap-agent-3.12-6.60.1.i586",
"product": {
"name": "google-cloud-sap-agent-3.12-6.60.1.i586",
"product_id": "google-cloud-sap-agent-3.12-6.60.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "google-cloud-sap-agent-3.12-6.60.1.ppc64le",
"product": {
"name": "google-cloud-sap-agent-3.12-6.60.1.ppc64le",
"product_id": "google-cloud-sap-agent-3.12-6.60.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "google-cloud-sap-agent-3.12-6.60.1.s390x",
"product": {
"name": "google-cloud-sap-agent-3.12-6.60.1.s390x",
"product_id": "google-cloud-sap-agent-3.12-6.60.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-cloud-sap-agent-3.12-6.60.1.x86_64",
"product": {
"name": "google-cloud-sap-agent-3.12-6.60.1.x86_64",
"product_id": "google-cloud-sap-agent-3.12-6.60.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:12"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-6.60.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.aarch64"
},
"product_reference": "google-cloud-sap-agent-3.12-6.60.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-6.60.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.ppc64le"
},
"product_reference": "google-cloud-sap-agent-3.12-6.60.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-6.60.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.s390x"
},
"product_reference": "google-cloud-sap-agent-3.12-6.60.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-cloud-sap-agent-3.12-6.60.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.x86_64"
},
"product_reference": "google-cloud-sap-agent-3.12-6.60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-cloud-sap-agent-3.12-6.60.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-07T09:25:22Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…