{
  "affected": [
    {
      "affectedData": [
        {
          "product": "ip-address",
          "vendor": "beaugunderson",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.3.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4(\u0027012.0.0.1\u0027) reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch(\u0027http://012.0.0.1/\u0027) connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1."
    }
  ],
  "id": "CVE-2026-69192",
  "lastModified": "2026-08-04T15:16:41.660",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-69192",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-04T13:59:11.084723Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-03T20:17:29.960",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.3.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "ip-address"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69192"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-03T19:59:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`Address4` accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, `inet_aton`, and `getaddrinfo` all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. `new Address4(\u0027012.0.0.1\u0027)` reports `correctForm()` of `12.0.0.1` and `isPrivate()` of `false`, but `fetch(\u0027http://012.0.0.1/\u0027)` connects to `10.0.0.1`.\n\nAn application that builds a network trust-boundary decision on these checks (for example a filter intended to block Server-Side Request Forgery, or SSRF) will classify an internal target as external and allow the request. SSRF is an attack in which a user-supplied address coaxes the server into making a request to an internal destination the user could not otherwise reach, such as a loopback service or a cloud metadata endpoint.\n\n### Details\n\n`Address4.parse` gates untrusted input on `RE_ADDRESS` (`src/v4/constants.ts:5`), whose per-octet alternative is:\n\n```\n(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\n```\n\nThe `[01]?[0-9][0-9]?` branch matches a leading zero, so `012` passes validation. Every downstream decode then reads the octet with `parseInt(part, 10)` (`src/common.ts:87`), yielding 12. A resolver reading the same string treats the leading `0` as base 8 and yields 10.\n\nThe defect is in the parse gate rather than in any one classifier, so every consumer of `Address4` inherits it: `isPrivate()`, `isLoopback()`, `isLinkLocal()`, `isCGNAT()`, `isInSubnet()`, `isHostInSubnet()`, and `correctForm()` are all computed from the mis-decoded octets.\n\n`Address6` already rejects this notation on its IPv4-in-IPv6 path, throwing \"IPv4 addresses can\u0027t have leading zeroes.\" (`src/ipv6.ts:751-762`), so `Address4` is the outlier within the library.\n\n### Affected versions\n\n`\u003c= 10.3.0`. Unlike GHSA-22jq-vg5j-6vgg and GHSA-4xrf-jv44-h6hh, which were bounded below by the `is*` classification API introduced in 10.1.1, this defect is in `parse` and reaches every release: a guard built on `isInSubnet()` against the RFC 1918 ranges is affected in versions predating that API.\n\n### Impact\n\nThe disagreement runs in both directions. Under-blocking is the security-relevant case; over-blocking is a correctness and availability problem.\n\n| Input | `correctForm()` | Classified as | Resolver reaches | Effect |\n|---|---|---|---|---|\n| `012.0.0.1` | `12.0.0.1` | public | `10.0.0.1` | internal target allowed |\n| `012.012.012.012` | `12.12.12.12` | public | `10.10.10.10` | internal target allowed |\n| `010.0.0.1` | `10.0.0.1` | private | `8.0.0.1` | public target blocked |\n\nReachable targets are those whose leading octet is expressible as a three-character octal literal, which covers the whole of `10.0.0.0/8` and `0.0.0.0/8`. A four-character octet such as `0177` for 127 is rejected by the regex, so loopback is not reachable through this path; see the note on rejection below for why rejection is not the same as safety.\n\n### Reachability\n\nA leading-zero address is a legal URL host, so this is reachable through the ordinary URL path with no unusual application shape required:\n\n```js\nnew URL(\u0027http://012.0.0.1/\u0027).hostname   // \u002710.0.0.1\u0027\n```\n\nThis distinguishes it from GHSA-4xrf-jv44-h6hh, where the `/0` CIDR suffix could not survive URL parsing and exploitation therefore required an application that accepted a bare suffix-bearing string. Here the attack rides the same code path a normal user-supplied URL takes.\n\n### Proof of concept\n\n`npm i ip-address@10.3.0`, then:\n\n```js\nconst { Address4 } = require(\u0027ip-address\u0027);\n\n// A guard of the shape the library documents.\nfunction isBlocked(host) {\n  return Address4.isValid(host) \u0026\u0026 new Address4(host).isPrivate();\n}\n\nfor (const h of [\u002710.0.0.1\u0027, \u0027012.0.0.1\u0027, \u0027012.012.012.012\u0027]) {\n  console.log(isBlocked(h) ? \u0027BLOCK\u0027 : \u0027ALLOW\u0027, h,\n              \u0027-\u003e resolver reaches\u0027, new URL(\u0027http://\u0027 + h + \u0027/\u0027).hostname);\n}\n```\n\nOn affected versions:\n\n```\nBLOCK 10.0.0.1 -\u003e resolver reaches 10.0.0.1\nALLOW 012.0.0.1 -\u003e resolver reaches 10.0.0.1\nALLOW 012.012.012.012 -\u003e resolver reaches 10.10.10.10\n```\n\nThe literal RFC 1918 address is blocked as expected; the octal-ambiguous spellings of the same destinations are allowed through.\n\n### Remediation\n\nUpgrade to the patched release. In the fix, `Address4.parse` rejects any octet with a leading zero followed by further digits, mirroring the check `Address6` already applies at `src/ipv6.ts:751`, and `RE_ADDRESS` is tightened so those forms no longer appear in the valid corpus. After upgrading, `Address4.isValid(\u0027012.0.0.1\u0027)` returns `false` and the constructor throws `AddressError`.\n\nThis rejects input that previous releases accepted. An application that deliberately feeds zero-padded addresses such as `010.010.010.010` from a legacy system must strip the padding before parsing.\n\nIf you cannot upgrade immediately, reject any host whose octets carry a leading zero before you parse it:\n\n```js\nif (host.split(\u0027.\u0027).some((octet) =\u003e /^0\\d/.test(octet))) throw new Error(\u0027ambiguous address\u0027);\n```\n\n### A note on SSRF defense\n\nThese methods are address classifiers, not a complete SSRF defense. Regardless of this fix, a robust SSRF guard must resolve the hostname and validate the *resolved* IP against the socket it connects to, and account for DNS rebinding and redirects. Treat these checks as one layer, not the only one.\n\nOne specific pitfall is worth naming, because the fix above does not remove it. `Address4.isValid()` returning `false` means \"this is not a dotted-quad IPv4 literal\"; it does not mean \"this is not an address that will reach an internal host\". Every one of the following is rejected by `isValid()` and still resolves to loopback:\n\n```\n0177.0.0.1    0x7f.0.0.1    0x7f000001    2130706433\n127.1         127.0.1       127.0.0.1.    \uff11\uff12\uff17.0.0.1\n```\n\nA guard shaped `if (Address4.isValid(h)) { check() } else { treatAsHostname() }` therefore routes all of them past the IP check. Rejecting these is correct behavior for an IPv4 parser and is not changed by this advisory, but a guard must treat \"not a valid literal\" as a case to resolve and re-check, never as a case to allow.",
  "id": "GHSA-mwp4-54f8-5fhr",
  "modified": "2026-08-03T19:59:44Z",
  "published": "2026-08-03T19:59:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/beaugunderson/ip-address"
    },
    {
      "type": "WEB",
      "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.1:\n  * grafana13.1-13.1.1-0.5.2.hum1 (aarch64, x86_64)\n  * grafana13.1-13.1.1-0.5.2.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana13.1:\n  * CVE-2026-67313\n  * CVE-2026-67314\n  * CVE-2026-67315\n  * CVE-2026-67316\n  * CVE-2026-67317\n  * CVE-2026-67318\n  * CVE-2026-69152\n  * CVE-2026-69153\n  * CVE-2026-69192\n  * CVE-2026-69198",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:50826",
        "url": "https://access.redhat.com/errata/RHSA-2026:50826"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67315",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67315"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67316",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67316"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67317",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67317"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67318",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67318"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69152",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69192",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69198",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69198"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50826.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-09T10:55:32+00:00",
      "generator": {
        "date": "2026-08-09T10:55:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.12"
        }
      },
      "id": "RHSA-2026:50826",
      "initial_release_date": "2026-08-05T14:18:29+00:00",
      "revision_history": [
        {
          "date": "2026-08-05T14:18:29+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-08T04:36:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-09T10:55:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@aarch64",
                "product": {
                  "name": "grafana13-1-main@aarch64",
                  "product_id": "grafana13-1-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@src",
                "product": {
                  "name": "grafana13-1-main@src",
                  "product_id": "grafana13-1-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@x86_64",
                "product": {
                  "name": "grafana13-1-main@x86_64",
                  "product_id": "grafana13-1-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@aarch64"
        },
        "product_reference": "grafana13-1-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@src"
        },
        "product_reference": "grafana13-1-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@x86_64"
        },
        "product_reference": "grafana13-1-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-67313",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2026-08-01T13:03:08.824485+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510017"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510017",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510017"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"
        }
      ],
      "release_date": "2026-08-01T12:22:16.493000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
    },
    {
      "cve": "CVE-2026-67314",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:03:49.884962+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510030"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510030",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
        }
      ],
      "release_date": "2026-08-01T12:22:16.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
    },
    {
      "cve": "CVE-2026-67315",
      "cwe": {
        "id": "CWE-115",
        "name": "Misinterpretation of Input"
      },
      "discovery_date": "2026-08-01T13:03:15.269330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510019"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability occurs because the software fails to correctly identify 0.0.0.0 as a local loopback address when evaluating NO_PROXY rules. A remote attacker could exploit this by providing a 0.0.0.0 URL, causing requests to bypass intended proxy restrictions. This could lead to the exposure of internal services to the configured proxy, potentially allowing unauthorized access to local resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: NO_PROXY bypass allows exposure of local services",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67315"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510019",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510019"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67315",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67315"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67315",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67315"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via",
          "url": "https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via"
        }
      ],
      "release_date": "2026-08-01T12:22:18.103000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: axios: NO_PROXY bypass allows exposure of local services"
    },
    {
      "cve": "CVE-2026-67316",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:02:42.878796+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510009"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker injecting unauthorized data into requests that were not intended to have a body. In more advanced scenarios, an attacker could also redirect network traffic through their own malicious servers or manipulate how URLs are processed, potentially exposing sensitive information or allowing traffic modification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67316"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510009",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510009"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67316",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67316"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67316",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67316"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"
        }
      ],
      "release_date": "2026-08-01T12:22:18.114000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection"
    },
    {
      "cve": "CVE-2026-67317",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:03:53.063442+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510031"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to uncontrolled network egress or resource exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67317"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510031",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510031"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67317",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67317"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67317",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67317"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream",
          "url": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream"
        }
      ],
      "release_date": "2026-08-01T12:22:16.662000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream"
    },
    {
      "cve": "CVE-2026-67318",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:01:38.074319+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509989"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an arbitrarily large amount of data. The primary impact is excessive resource consumption, increased network egress, and potential denial of service for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67318"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509989",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509989"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67318",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67318"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67318",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67318"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2",
          "url": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2"
        }
      ],
      "release_date": "2026-08-01T12:22:18.116000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests"
    },
    {
      "cve": "CVE-2026-69152",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-03T18:01:13.566423+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion library. An attacker can provide specially crafted input to the `expand()` function, which fails to apply length restrictions when creating intermediate arrays. This oversight allows the attacker to exhaust system memory or block the event loop, leading to a Denial of Service (DoS). This vulnerability bypasses a previous mitigation for CVE-2026-14257.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
          "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
          "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
          "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
        }
      ],
      "release_date": "2026-08-03T16:33:36.324000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays"
    },
    {
      "cve": "CVE-2026-69153",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-03T18:01:01.506065+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
          "url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
          "url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
        }
      ],
      "release_date": "2026-08-03T16:56:25.733000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        },
        {
          "category": "workaround",
          "details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
    },
    {
      "cve": "CVE-2026-69192",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "discovery_date": "2026-08-03T21:02:17.374935+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e",
          "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1",
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
        }
      ],
      "release_date": "2026-08-03T19:56:13.640000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    },
    {
      "cve": "CVE-2026-69198",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "discovery_date": "2026-08-03T21:02:27.972296+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510803"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing (CIDR) suffix to an IP address, an attacker can bypass the library\u0027s special-use classification methods. This misclassification can lead applications, such as those designed to prevent Server-Side Request Forgery (SSRF), to incorrectly treat internal network targets as external. Consequently, an attacker may be able to access internal resources or bypass other network trust-boundary checks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat products that ship the affected ip-address library versions use it in browser-side UI components for IP address display and form validation, not for server-side request filtering or SSRF protection. The classification bypass has no security-relevant effect in this context because no trust-boundary decisions are built on these client-side checks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69198"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510803",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510803"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69198",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69198"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69198",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69198"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d",
          "url": "https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2",
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh"
        }
      ],
      "release_date": "2026-08-03T19:59:05.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        },
        {
          "category": "workaround",
          "details": "Validate and sanitize CIDR suffixes on IP address input before passing them to the ip-address library. Reject any user-supplied address where the prefix length is outside the valid range for the address family (0-32 for IPv4, 0-128 for IPv6) or where the prefix length contradicts the intended classification check. Applications that rely on ip-address for SSRF filtering should add an independent server-side check that does not depend on the library\u0027s classification methods.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana12.4:\n  * grafana12.4-12.4.6-0.4.1.hum1 (aarch64, x86_64)\n  * grafana12.4-12.4.6-0.4.1.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana12.4:\n  * CVE-2026-69192",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:50854",
        "url": "https://access.redhat.com/errata/RHSA-2026:50854"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69192",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50854.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-09T08:47:07+00:00",
      "generator": {
        "date": "2026-08-09T08:47:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.12"
        }
      },
      "id": "RHSA-2026:50854",
      "initial_release_date": "2026-08-05T17:11:37+00:00",
      "revision_history": [
        {
          "date": "2026-08-05T17:11:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-08T04:36:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-09T08:47:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12-4-main@aarch64",
                "product": {
                  "name": "grafana12-4-main@aarch64",
                  "product_id": "grafana12-4-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.6-0.4.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12-4-main@src",
                "product": {
                  "name": "grafana12-4-main@src",
                  "product_id": "grafana12-4-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.6-0.4.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12-4-main@x86_64",
                "product": {
                  "name": "grafana12-4-main@x86_64",
                  "product_id": "grafana12-4-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.6-0.4.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12-4-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12-4-main@aarch64"
        },
        "product_reference": "grafana12-4-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12-4-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12-4-main@src"
        },
        "product_reference": "grafana12-4-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12-4-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12-4-main@x86_64"
        },
        "product_reference": "grafana12-4-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-69192",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "discovery_date": "2026-08-03T21:02:17.374935+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12-4-main@aarch64",
          "Red Hat Hardened Images:grafana12-4-main@src",
          "Red Hat Hardened Images:grafana12-4-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e",
          "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1",
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
        }
      ],
      "release_date": "2026-08-03T19:56:13.640000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T17:11:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50854"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.1:\n  * grafana13.1-13.1.2-0.1.hum1 (aarch64, x86_64)\n  * grafana13.1-13.1.2-0.1.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana13.1:\n  * CVE-2026-69192",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:50956",
        "url": "https://access.redhat.com/errata/RHSA-2026:50956"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69192",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50956.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-09T10:31:32+00:00",
      "generator": {
        "date": "2026-08-09T10:31:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.12"
        }
      },
      "id": "RHSA-2026:50956",
      "initial_release_date": "2026-08-06T01:06:27+00:00",
      "revision_history": [
        {
          "date": "2026-08-06T01:06:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-08T04:36:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-09T10:31:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@aarch64",
                "product": {
                  "name": "grafana13-1-main@aarch64",
                  "product_id": "grafana13-1-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.2-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@src",
                "product": {
                  "name": "grafana13-1-main@src",
                  "product_id": "grafana13-1-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.2-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@x86_64",
                "product": {
                  "name": "grafana13-1-main@x86_64",
                  "product_id": "grafana13-1-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.2-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@aarch64"
        },
        "product_reference": "grafana13-1-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@src"
        },
        "product_reference": "grafana13-1-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@x86_64"
        },
        "product_reference": "grafana13-1-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-69192",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "discovery_date": "2026-08-03T21:02:17.374935+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e",
          "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1",
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
        }
      ],
      "release_date": "2026-08-03T19:56:13.640000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T01:06:27+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50956"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana12.4:\n  * grafana12.4-12.4.7-0.1.hum1 (aarch64, x86_64)\n  * grafana12.4-12.4.7-0.1.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana12.4:\n  * CVE-2026-69192",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:50969",
        "url": "https://access.redhat.com/errata/RHSA-2026:50969"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69192",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50969.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-09T11:22:32+00:00",
      "generator": {
        "date": "2026-08-09T11:22:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.12"
        }
      },
      "id": "RHSA-2026:50969",
      "initial_release_date": "2026-08-06T02:05:30+00:00",
      "revision_history": [
        {
          "date": "2026-08-06T02:05:30+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-08T04:36:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-09T11:22:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12-4-main@aarch64",
                "product": {
                  "name": "grafana12-4-main@aarch64",
                  "product_id": "grafana12-4-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.7-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12-4-main@src",
                "product": {
                  "name": "grafana12-4-main@src",
                  "product_id": "grafana12-4-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.7-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12-4-main@x86_64",
                "product": {
                  "name": "grafana12-4-main@x86_64",
                  "product_id": "grafana12-4-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.7-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12-4-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12-4-main@aarch64"
        },
        "product_reference": "grafana12-4-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12-4-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12-4-main@src"
        },
        "product_reference": "grafana12-4-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12-4-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12-4-main@x86_64"
        },
        "product_reference": "grafana12-4-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-69192",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "discovery_date": "2026-08-03T21:02:17.374935+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12-4-main@aarch64",
          "Red Hat Hardened Images:grafana12-4-main@src",
          "Red Hat Hardened Images:grafana12-4-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e",
          "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1",
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
        }
      ],
      "release_date": "2026-08-03T19:56:13.640000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T02:05:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50969"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    }
  ]
}