Vulnerability-Lookup

CERTFR-2026-AVI-1249

Vulnerability from certfr_avis - Published: 2026-10-02 - Updated: 2026-10-02

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
VMware	Tanzu	VMware Tanzu pour Valkey on Kubernetes versions antérieures à 3.5.1
VMware	Tanzu	VMware Tanzu pour Postgres on Kubernetes versions antérieures à 4.5.2
VMware	Spring Cloud Gateway	Spring Cloud Gateway pour Kubernetes versions antérieures à 2.2.17
VMware	Tanzu	VMware Tanzu pour Valkey versions antérieures à 8.0.11
VMware	Tanzu	VMware Tanzu pour Valkey versions 9.0.x antérieures à 9.0.6
VMware	Tanzu	VMware Tanzu pour Valkey versions 8.1.x antérieures à 8.1.10
VMware	Tanzu	VMware Tanzu pour Valkey versions 9.1.x antérieures à 9.1.2
VMware	Spring Cloud Data Flow	Spring Cloud Data Flow pour Kubernetes versions antérieures à 1.6.16

References

Title

Publication Time

CVE-2026-42501 (GCVE-0-2026-42501)

Vulnerability from cvelistv5 – Published: 2026-05-07 19:41 – Updated: 2026-05-08 15:48

Title

Malicious module proxy can bypass checksum database in cmd/go

Summary

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running "rm go.sum ; go mod tidy ; go mod verify", which will revalidate all dependencies of the current module. The specific flaw in more detail: The go command consults the checksum database to validate downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash reported by the checksum database matches the hash of the downloaded module. If, however, the checksum database returns a successful response that contains no entry for the module, the go command incorrectly permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case the go command will not connect to the checksum database directly. Checksums reported by the checksum database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated module, could cause the go command to proceed as if a downloaded module has been validated.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-08 15:48 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

Go Google root Scorecard

References

4 references

URL	Tags
https://go.dev/cl/775321
https://go.dev/issue/79070
https://groups.google.com/g/golang-announce/c/qcC…
https://pkg.go.dev/vuln/GO-2026-4984

Impacted products

1 product

Vendor	Product	Version
Go toolchain	cmd/go	Affected: 0 , < 1.25.10 (semver) Affected: 1.26.0-0 , < 1.26.3 (semver)

Credits

Mundur (https://github.com/M0nd0R)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42501",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T15:48:05.053316Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "CWE-347 Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T15:48:47.404Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.3",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mundur (https://github.com/M0nd0R)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious module proxy can exploit a flaw in the go command\u0027s validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module\u0027s dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running \"rm go.sum ; go mod tidy ; go mod verify\", which will revalidate all dependencies of the current module. The specific flaw in more detail: The go command consults the checksum database to validate downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash reported by the checksum database matches the hash of the downloaded module. If, however, the checksum database returns a successful response that contains no entry for the module, the go command incorrectly permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case the go command will not connect to the checksum database directly. Checksums reported by the checksum database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated module, could cause the go command to proceed as if a downloaded module has been validated."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T19:41:19.691Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/775321"
        },
        {
          "url": "https://go.dev/issue/79070"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4984"
        }
      ],
      "title": "Malicious module proxy can bypass checksum database in cmd/go"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42501",
    "datePublished": "2026-05-07T19:41:19.691Z",
    "dateReserved": "2026-04-28T00:21:12.791Z",
    "dateUpdated": "2026-05-08T15:48:47.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42504 (GCVE-0-2026-42504)

Vulnerability from cvelistv5 – Published: 2026-06-02 22:01 – Updated: 2026-10-01 20:48

Title

Quadratic complexity in WordDecoder.DecodeHeader in mime

Summary

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-03 14:05 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

Go Google root Scorecard

References

4 references

URL	Tags
https://go.dev/issue/79217
https://go.dev/cl/774481
https://groups.google.com/g/golang-announce/c/tKs…
https://pkg.go.dev/vuln/GO-2026-5038

Impacted products

1 product

Vendor	Product	Version
Go standard library	mime	Affected: 0 , < 1.25.11 (semver) Affected: 1.26.0-0 , < 1.26.4 (semver)

Credits

p4p3r (https://hackerone.com/p4p3r_hak)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42504",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T14:05:39.682615Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-407",
                "description": "CWE-407 Inefficient Algorithmic Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T14:06:13.623Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "mime",
          "product": "mime",
          "programRoutines": [
            {
              "name": "WordDecoder.DecodeHeader"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.4",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "p4p3r (https://hackerone.com/p4p3r_hak)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T20:48:03.177Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79217"
        },
        {
          "url": "https://go.dev/cl/774481"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "title": "Quadratic complexity in WordDecoder.DecodeHeader in mime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42504",
    "datePublished": "2026-06-02T22:01:37.219Z",
    "dateReserved": "2026-04-28T00:21:12.792Z",
    "dateUpdated": "2026-10-01T20:48:03.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42505 (GCVE-0-2026-42505)

Vulnerability from cvelistv5 – Published: 2026-07-08 15:46 – Updated: 2026-07-08 19:38

Title

Invoking Encrypted Client Hello privacy leak in crypto/tls

Summary

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-08 18:03 UTC

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

Go Google root Scorecard

References

4 references

URL	Tags
https://go.dev/cl/775960
https://go.dev/issue/79282
https://groups.google.com/g/golang-announce/c/Orm…
https://pkg.go.dev/vuln/GO-2026-5856

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/tls	Affected: 0 , < 1.25.12 (semver) Affected: 1.26.0-0 , < 1.26.5 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.2 (semver)

Credits

Coia Prant (github.com/rbqvq)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T18:03:53.821942Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-201",
                "description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T19:38:17.603Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "clientHelloMsg.marshalMsg"
            },
            {
              "name": "Conn.Handshake"
            },
            {
              "name": "Conn.HandshakeContext"
            },
            {
              "name": "Conn.Read"
            },
            {
              "name": "Conn.Write"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DialWithDialer"
            },
            {
              "name": "Dialer.Dial"
            },
            {
              "name": "Dialer.DialContext"
            },
            {
              "name": "QUICConn.HandleData"
            },
            {
              "name": "QUICConn.SendSessionTicket"
            },
            {
              "name": "QUICConn.Start"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.5",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.2",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Coia Prant (github.com/rbqvq)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T15:46:33.407Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/775960"
        },
        {
          "url": "https://go.dev/issue/79282"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5856"
        }
      ],
      "title": "Invoking Encrypted Client Hello privacy leak in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42505",
    "datePublished": "2026-07-08T15:46:33.407Z",
    "dateReserved": "2026-04-28T00:21:12.792Z",
    "dateUpdated": "2026-07-08T19:38:17.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42507 (GCVE-0-2026-42507)

Vulnerability from cvelistv5 – Published: 2026-06-02 22:01 – Updated: 2026-06-03 19:04

Title

Arbitrary inputs are included in errors without any escaping in net/textproto

Summary

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-03 19:04 UTC

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

Go Google root Scorecard

References

4 references

URL	Tags
https://go.dev/issue/79346
https://go.dev/cl/777060
https://groups.google.com/g/golang-announce/c/tKs…
https://pkg.go.dev/vuln/GO-2026-5039

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/textproto	Affected: 0 , < 1.25.11 (semver) Affected: 1.26.0-0 , < 1.26.4 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42507",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T19:04:08.223332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T19:04:45.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/textproto",
          "product": "net/textproto",
          "programRoutines": [
            {
              "name": "parseCodeLine"
            },
            {
              "name": "Reader.ReadCodeLine"
            },
            {
              "name": "readMIMEHeader"
            },
            {
              "name": "Error.Error"
            },
            {
              "name": "Reader.ReadMIMEHeader"
            },
            {
              "name": "Reader.ReadResponse"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.4",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T22:01:37.307Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79346"
        },
        {
          "url": "https://go.dev/cl/777060"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5039"
        }
      ],
      "title": "Arbitrary inputs are included in errors without any escaping in net/textproto"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42507",
    "datePublished": "2026-06-02T22:01:37.307Z",
    "dateReserved": "2026-04-28T00:21:12.792Z",
    "dateUpdated": "2026-06-03T19:04:45.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42508 (GCVE-0-2026-42508)

Vulnerability from cvelistv5 – Published: 2026-05-22 02:31 – Updated: 2026-09-15 12:04

Title

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Summary

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-22 18:43 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

Go Google root Scorecard

References

49 references

URL	Tags
https://go.dev/issue/79568
https://go.dev/cl/781220
https://groups.google.com/g/golang-announce/c/a08…
https://pkg.go.dev/vuln/GO-2026-5021
https://access.redhat.com/security/cve/CVE-2026-42508	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2480688	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:41019	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36796	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37072	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35833	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51288	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49944	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67450	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37123	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61314	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36808	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66521	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51033	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59467	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66022	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43692	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41064	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47737	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54400	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26546	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26547	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36651	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40945	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40118	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23264	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65126	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60520	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36648	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41036	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52857	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52910	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37387	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41031	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42146	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43052	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42796	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41066	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36797	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57194	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:46885	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47735	vendor-advisoryx_refsource_REDHAT

Impacted products

90 products

Vendor	Product	Version
golang.org/x/crypto	golang.org/x/crypto/ssh/knownhosts	Affected: 0 , < 0.52.0 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 7:5.8.2-4.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260701102925.afee755d , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260803064027.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260803064027.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260721142025.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260721142025.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 6:5.8.2-4.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	RHEM 1.0 for RHEL 9	Unaffected: 0:1.0.3-1.el9em , < * (rpm) cpe:/a:redhat:edge_manager:1.0::el9
Red Hat	RHEM 1.1 for RHEL 10	Unaffected: 0:1.1.3-1.el10em , < * (rpm) cpe:/a:redhat:edge_manager:1.1::el10
Red Hat	RHEM 1.1 for RHEL 9	Unaffected: 0:1.1.3-1.el9em , < * (rpm) cpe:/a:redhat:edge_manager:1.1::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1787593637 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	DevWorkspace Operator 0.42	Unaffected: 1782401674 , < * (rpm) cpe:/a:redhat:devworkspace:0.42::el9
Red Hat	Logging Subsystem for Red Hat OpenShift 6.6	Unaffected: 1788439505 , < * (rpm) cpe:/a:redhat:logging:6.6::el9
Red Hat	multicluster engine for Kubernetes 2.1	Unaffected: 1784646026 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.10::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911957 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786912006 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.8	Unaffected: 1784646786 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	OpenShift API for Data Protection 1.3	Unaffected: 1785177359 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.3::el9
Red Hat	OpenShift API for Data Protection 1.4	Unaffected: 1786946294 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.4::el9
Red Hat	OpenShift API for Data Protection 1.5	Unaffected: 1788859896 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.5::el9
Red Hat	OpenShift API for Data Protection 1.6	Unaffected: 1784058822 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.6::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	Unaffected: 1783813250 , < * (rpm) cpe:/a:redhat:acm:2.11::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	Unaffected: 1784740143 , < * (rpm) cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1786456658 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Security 4.9	Unaffected: 1781686446 , < * (rpm) cpe:/a:redhat:advanced_cluster_security:4.9::el8
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.10	Unaffected: 1781686458 , < * (rpm) cpe:/a:redhat:advanced_cluster_security:4.10::el8
Red Hat	Red Hat Edge Manager 1.0	Unaffected: 1783502025 , < * (rpm) cpe:/a:redhat:edge_manager:1.0::el9
Red Hat	Red Hat Edge Manager 1.1	Unaffected: 1784196588 , < * (rpm) cpe:/a:redhat:edge_manager:1.1::el10
Red Hat	Red Hat Edge Manager 1.1	Unaffected: 1784126780 , < * (rpm) cpe:/a:redhat:edge_manager:1.1::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.25.11-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 1.26.4-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift AI 2.25	Unaffected: 1788181065 , < * (rpm) cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat	Red Hat OpenShift AI 2.25	Unaffected: 1788181054 , < * (rpm) cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787002529 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787001948 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift Builds 1.7.3	Unaffected: 1783057868 , < * (rpm) cpe:/a:redhat:openshift_builds:1.7::el9
Red Hat	Red Hat OpenShift Builds 1.8.1	Unaffected: 1784121108 , < * (rpm) cpe:/a:redhat:openshift_builds:1.8::el9
Red Hat	Red Hat OpenShift Builds 1.8.1	Unaffected: 1783612119 , < * (rpm) cpe:/a:redhat:openshift_builds:1.8::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782932114 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782931768 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782932104 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783536000 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783535989 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783536515 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782932521 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783018461 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783018421 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782932812 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783537001 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782932919 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783537586 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782932969 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782933015 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782933042 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783537392 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782933235 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782933251 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783537955 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782933417 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783537742 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782933602 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1783019377 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782934054 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782934036 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	Unaffected: 1782934284 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat OpenShift GitOps 1.19	Unaffected: 1785149260 , < * (rpm) cpe:/a:redhat:openshift_gitops:1.19::el8
Red Hat	Red Hat OpenShift GitOps 1.20	Unaffected: 1785211346 , < * (rpm) cpe:/a:redhat:openshift_gitops:1.20::el9
Red Hat	Red Hat Quay 3.10	Unaffected: 1783750447 , < * (rpm) cpe:/a:redhat:quay:3.10::el8
Red Hat	Red Hat Quay 3.12	Unaffected: 1783751865 , < * (rpm) Unaffected: 1784353904 , < * (rpm) cpe:/a:redhat:quay:3.12::el8
Red Hat	Red Hat Quay 3.15	Unaffected: 1784351966 , < * (rpm) cpe:/a:redhat:quay:3.15::el8
Red Hat	Red Hat Quay 3.16	Unaffected: 1783955846 , < * (rpm) cpe:/a:redhat:quay:3.16::el9
Red Hat	Red Hat Quay 3.9	Unaffected: 1784125838 , < * (rpm) cpe:/a:redhat:quay:3.9::el8
Red Hat	Red Hat Trusted Artifact Signer 1.4	Unaffected: 4-1.4.2 , < * (rpm) Unaffected: 4-1.4.3 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.4::el9
Red Hat	Assisted Installer for Red Hat OpenShift Container Platform 2	cpe:/a:redhat:assisted_installer:2
Red Hat	cert-manager Operator for Red Hat OpenShift	cpe:/a:redhat:cert_manager:1
Red Hat	ExternalDNS Operator	cpe:/a:redhat:ext_dns_optr:1
Red Hat	External Secrets Operator for Red Hat OpenShift	cpe:/a:redhat:external_secrets_operator:1
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat OpenStack Platform 17.1	cpe:/a:redhat:openstack:17.1
Red Hat	Red Hat OpenStack Platform 18.0	cpe:/a:redhat:openstack:18.0
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3

Credits

Omar Khaleel Ibrahim - mr3okk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42508",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-22T18:43:40.584666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-22T18:44:33.483Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "7:5.8.2-4.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "container-tools:rhel8",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260701102925.afee755d",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "container-tools:rhel8",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260803064027.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "container-tools:rhel8",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260803064027.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "container-tools:rhel8",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260721142025.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "container-tools:rhel8",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260721142025.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "6:5.8.2-4.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.0 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.0.3-1.el9em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.1::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.1 for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.1.3-1.el10em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.1.3-1.el9em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/cluster-observability-rhel9-operator",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787593637",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:devworkspace:0.42::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devworkspace/devworkspace-rhel9-operator",
            "product": "DevWorkspace Operator 0.42",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782401674",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/cluster-logging-rhel9-operator",
            "product": "Logging Subsystem for Red Hat OpenShift 6.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1788439505",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784646026",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911957",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786912006",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/cluster-image-set-controller-rhel9",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784646786",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-mustgather-rhel9",
            "product": "OpenShift API for Data Protection 1.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785177359",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-mustgather-rhel9",
            "product": "OpenShift API for Data Protection 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786946294",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-mustgather-rhel9",
            "product": "OpenShift API for Data Protection 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1788859896",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-rhel9",
            "product": "OpenShift API for Data Protection 1.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784058822",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783813250",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/multicluster-operators-subscription-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784740143",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/volsync-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786456658",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.9::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security 4.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1781686446",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.10::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1781686458",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhem/flightctl-api-rhel9",
            "product": "Red Hat Edge Manager 1.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783502025",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.1::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "rhem/flightctl-api-rhel10",
            "product": "Red Hat Edge Manager 1.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784196588",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhem/flightctl-api-rhel9",
            "product": "Red Hat Edge Manager 1.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784126780",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-25-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.25.11-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-26-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.26.4-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1788181065",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1788181054",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787002529",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787001948",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-waiters-rhel9",
            "product": "Red Hat OpenShift Builds 1.7.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783057868",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-rhel9-operator",
            "product": "Red Hat OpenShift Builds 1.8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784121108",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-builds/openshift-builds-waiters-rhel9",
            "product": "Red Hat OpenShift Builds 1.8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783612119",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782932114",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782931768",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/devicefinder-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782932104",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783536000",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783535989",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783536515",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782932521",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783018461",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783018421",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-blackbox-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782932812",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783537001",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782932919",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783537586",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782932969",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782933015",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782933042",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-drbd-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783537392",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782933235",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782933251",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783537955",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782933417",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783537742",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782933602",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783019377",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-volsync-plugin-mover-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782934054",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-volsync-plugin-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782934036",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782934284",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1.19::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-gitops-1/argocd-rhel8",
            "product": "Red Hat OpenShift GitOps 1.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785149260",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-gitops-1/argocd-rhel9",
            "product": "Red Hat OpenShift GitOps 1.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785211346",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.10::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783750447",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783751865",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784353904",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784351966",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel9",
            "product": "Red Hat Quay 3.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783955846",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.9::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784125838",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "conforma-cli-stack-v1",
            "product": "Red Hat Trusted Artifact Signer 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4-1.4.2",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4-1.4.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:assisted_installer:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "assisted/agent-preinstall-image-builder-rhel9",
            "product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cert_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "cert-manager/cert-manager-operator-rhel9",
            "product": "cert-manager Operator for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cert_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "cert-manager/jetstack-cert-manager-rhel9",
            "product": "cert-manager Operator for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "edo/external-dns-rhel9",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:external_secrets_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "external-secrets-operator/external-secrets-rhel9",
            "product": "External Secrets Operator for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-chains-controller-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-results-api-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-results-watcher-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-plugin-func-func-util-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-clients",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "microshift",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-hypershift-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-prometheus-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-tests",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-tests-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "podman",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "affected",
            "packageName": "kubevirt",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "golang-googlecode-go-crypto",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp-rhel8/osp-director-agent",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp-rhel9/osp-director-agent",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoso-operators/prometheus-podman-exporter-rhel9",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-builder-rhel9",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-22T02:31:27.644Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-295",
                "description": "Improper Certificate Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:04:29.377Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42508"
          },
          {
            "name": "RHBZ#2480688",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41019"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36796"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37072"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35833"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51288"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49944"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67450"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61314"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66521"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51033"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59467"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66022"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43692"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41064"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47737"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54400"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26546"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26547"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36651"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40945"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40118"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23264"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65126"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60520"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36648"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41036"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52857"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52910"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37387"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41031"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42146"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43052"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42796"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41066"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36797"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57194"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:46885"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47735"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:41019: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36796: RHEM 1.0 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37072: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35833: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51288: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49944: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67450: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37123: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61314: Cluster Observability Operator 1.5.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36808: DevWorkspace Operator 0.42"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66521: Logging Subsystem for Red Hat OpenShift 6.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51033: OpenShift API for Data Protection 1.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59467: OpenShift API for Data Protection 1.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66022: OpenShift API for Data Protection 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43692: OpenShift API for Data Protection 1.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41064: Red Hat Advanced Cluster Management for Kubernetes 2.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47737: Red Hat Advanced Cluster Management for Kubernetes 2.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54400: Red Hat Advanced Cluster Management for Kubernetes 2.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26546: Red Hat Advanced Cluster Security 4.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26547: Red Hat Advanced Cluster Security for Kubernetes 4.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36651: Red Hat Edge Manager 1.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40945: Red Hat Edge Manager 1.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40118: Red Hat Edge Manager 1.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23262: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23264: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65126: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60520: Red Hat OpenShift AI 3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36648: Red Hat OpenShift Builds 1.7.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41036: Red Hat OpenShift Builds 1.8.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52857: Red Hat OpenShift GitOps 1.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52910: Red Hat OpenShift GitOps 1.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41031: Red Hat Quay 3.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42146: Red Hat Quay 3.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43052: Red Hat Quay 3.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42796: Red Hat Quay 3.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41066: Red Hat Quay 3.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40262: Red Hat Quay 3.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57194: multicluster engine for Kubernetes 2.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:46885: multicluster engine for Kubernetes 2.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47735: multicluster engine for Kubernetes 2.8"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-22T04:01:49.515Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-22T02:31:27.644Z",
            "value": "Made public."
          }
        ],
        "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh/knownhosts",
          "product": "golang.org/x/crypto/ssh/knownhosts",
          "programRoutines": [
            {
              "name": "hostKeyDB.IsRevoked"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.52.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Omar Khaleel Ibrahim - mr3okk"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T16:38:13.877Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79568"
        },
        {
          "url": "https://go.dev/cl/781220"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5021"
        }
      ],
      "title": "Invoking  auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42508",
    "datePublished": "2026-05-22T02:31:27.644Z",
    "dateReserved": "2026-04-28T00:21:12.792Z",
    "dateUpdated": "2026-09-15T12:04:29.377Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42764 (GCVE-0-2026-42764)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-06-10 07:47

Title

NULL Pointer Dereference in QUIC Server Initial Packet Handling

Summary

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 19:36 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

openssl mitre root Scorecard

References

4 references

URL	Tags
https://openssl-library.org/news/secadv/20260609.txt	vendor-advisory
https://github.com/openssl/openssl/commit/bf29a45…	patch
https://github.com/openssl/openssl/commit/a45a0ab…	patch
https://github.com/openssl/openssl/commit/5e3ed29…	patch

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 4.0.0 , < 4.0.1 (semver) Affected: 3.6.0 , < 3.6.3 (semver) Affected: 3.5.0 , < 3.5.7 (semver)

Date Public

2026-06-09 14:00

Credits

Sunwoo Lee (KENTECH) Hyuk Lim (KENTECH) Seunghyun Yoon (KENTECH) Sunwoo Lee (KENTECH) Hyuk Lim (KENTECH) Seunghyun Yoon (KENTECH)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42764",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T19:36:40.693568Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T19:37:01.285Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Sunwoo Lee (KENTECH)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Hyuk Lim (KENTECH)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Seunghyun Yoon (KENTECH)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Sunwoo Lee (KENTECH)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Hyuk Lim (KENTECH)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Seunghyun Yoon (KENTECH)"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Receiving a QUIC initial packet with an invalid token may\u003cbr\u003etrigger a NULL pointer dereference in the OpenSSL QUIC server with\u003cbr\u003eaddress validation disabled.\u003cbr\u003e\u003cbr\u003eImpact summary: NULL pointer dereference typically causes abnormal termination\u003cbr\u003eof the affected QUIC server process and a Denial of Service.\u003cbr\u003e\u003cbr\u003eIf the address validation is disabled in the OpenSSL QUIC server\u003cbr\u003eimplementation, an attacker can crash the server by sending an initial\u003cbr\u003epacket with an invalid or expired token.\u003cbr\u003e\u003cbr\u003eBy default, the client address validation is enabled in the OpenSSL QUIC server\u003cbr\u003eimplementation, which makes the default configuration not vulnerable\u003cbr\u003eto this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with\u003cbr\u003ethe SSL_new_listener() call, the address validation is disabled making the\u003cbr\u003evulnerable code reachable.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\u003cbr\u003eissue, as the affected code is outside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: Receiving a QUIC initial packet with an invalid token may\ntrigger a NULL pointer dereference in the OpenSSL QUIC server with\naddress validation disabled.\n\nImpact summary: NULL pointer dereference typically causes abnormal termination\nof the affected QUIC server process and a Denial of Service.\n\nIf the address validation is disabled in the OpenSSL QUIC server\nimplementation, an attacker can crash the server by sending an initial\npacket with an invalid or expired token.\n\nBy default, the client address validation is enabled in the OpenSSL QUIC server\nimplementation, which makes the default configuration not vulnerable\nto this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with\nthe SSL_new_listener() call, the address validation is disabled making the\nvulnerable code reachable.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Moderate"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:47:58.940Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677"
        },
        {
          "name": "3.5.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "NULL Pointer Dereference in QUIC Server Initial Packet Handling",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-42764",
    "datePublished": "2026-06-09T16:03:25.161Z",
    "dateReserved": "2026-04-29T09:22:27.967Z",
    "dateUpdated": "2026-06-10T07:47:58.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42766 (GCVE-0-2026-42766)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-06-10 07:48

Title

Possible NULL Dereference in Password-Based CMS Decryption

Summary

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 19:46 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

openssl mitre root Scorecard

References

6 references

URL	Tags
https://openssl-library.org/news/secadv/20260609.txt	vendor-advisory
https://github.com/openssl/openssl/commit/12bc26f…	patch
https://github.com/openssl/openssl/commit/da26f36…	patch
https://github.com/openssl/openssl/commit/056d06c…	patch
https://github.com/openssl/openssl/commit/ab52d88…	patch
https://github.com/openssl/openssl/commit/3ff6491…	patch

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 4.0.0 , < 4.0.1 (semver) Affected: 3.6.0 , < 3.6.3 (semver) Affected: 3.5.0 , < 3.5.7 (semver) Affected: 3.4.0 , < 3.4.6 (semver) Affected: 3.0.0 , < 3.0.21 (semver) Affected: 1.1.1 , < 1.1.1zh (custom) Affected: 1.0.2 , < 1.0.2zq (custom)

Date Public

2026-06-09 14:00

Credits

Mayank Jangid Kushal Khemka Hari Priandana Bhabani Sankar Das Qifan Zhang (Palo Alto Networks) Igor Ustinov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T19:46:24.673332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T19:46:27.585Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.21",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1zh",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zq",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Mayank Jangid"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Kushal Khemka"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Hari Priandana"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bhabani Sankar Das"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Qifan Zhang (Palo Alto Networks)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Igor Ustinov"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: A specially crafted password-encrypted CMS message\u003cbr\u003ecan trigger a NULL pointer dereference during CMS decryption.\u003cbr\u003e\u003cbr\u003eImpact summary: This NULL pointer dereference leads to an application crash\u003cbr\u003eand a Denial of Service.\u003cbr\u003e\u003cbr\u003eThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\u003cbr\u003eOPTIONAL in the ASN.1 specification and may therefore be absent in specially\u003cbr\u003ecrafted inputs. During the password-based CMS decryption the OpenSSL\u003cbr\u003eCMS implementation dereferences this field without first checking whether it\u003cbr\u003ewas present.\u003cbr\u003e\u003cbr\u003eAn attacker who supplies such a CMS message to an application performing\u003cbr\u003epassword-based CMS decryption can trigger an application crash, leading to\u003cbr\u003ea Denial of Service.\u003cbr\u003e\u003cbr\u003eApplications that process password-encrypted CMS messages may be affected.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\u003cbr\u003eissue, as the affected code is outside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:48:01.992Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8"
        },
        {
          "name": "3.5.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce"
        },
        {
          "name": "3.4.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4"
        },
        {
          "name": "3.0.21 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Possible NULL Dereference in Password-Based CMS Decryption",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-42766",
    "datePublished": "2026-06-09T16:03:26.679Z",
    "dateReserved": "2026-04-29T09:22:27.968Z",
    "dateUpdated": "2026-06-10T07:48:01.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42767 (GCVE-0-2026-42767)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-06-10 07:48

Title

NULL Pointer Dereference in CRMF EncryptedValue Decryption

Summary

Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 19:44 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

openssl mitre root Scorecard

References

6 references

URL	Tags
https://openssl-library.org/news/secadv/20260609.txt	vendor-advisory
https://github.com/openssl/openssl/commit/b90ff3b…	patch
https://github.com/openssl/openssl/commit/e6f9129…	patch
https://github.com/openssl/openssl/commit/810b722…	patch
https://github.com/openssl/openssl/commit/665d525…	patch
https://github.com/openssl/openssl/commit/61a86a8…	patch

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 4.0.0 , < 4.0.1 (semver) Affected: 3.6.0 , < 3.6.3 (semver) Affected: 3.5.0 , < 3.5.7 (semver) Affected: 3.4.0 , < 3.4.6 (semver) Affected: 3.0.0 , < 3.0.21 (semver)

Date Public

2026-06-09 14:00

Credits

Zhanpeng Liu (Tencent Xuanwu Lab) Guannan Wang (Tencent Xuanwu Lab) Guancheng Li (Tencent Xuanwu Lab) Bhabani Sankar Das Igor Ustinov Tomáš Mráz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T19:44:35.594012Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T19:45:04.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.21",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Zhanpeng Liu (Tencent Xuanwu Lab)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Guannan Wang (Tencent Xuanwu Lab)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Guancheng Li (Tencent Xuanwu Lab)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bhabani Sankar Das"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Igor Ustinov"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tom\u00e1\u0161 Mr\u00e1z"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\u003cbr\u003eserver could trigger a NULL pointer dereference in a CMP client application.\u003cbr\u003e\u003cbr\u003eImpact summary: A NULL pointer dereference causes a crash of the\u003cbr\u003eapplication and a Denial of Service.\u003cbr\u003e\u003cbr\u003eAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\u003cbr\u003ecraft a CMP response containing a CRMF (Certificate Request Message Format)\u003cbr\u003eCertRepMessage with an EncryptedValue structure where the symmAlg field\u003cbr\u003ehas an algorithm OID but no parameters field. When the OpenSSL CMP client\u003cbr\u003eprocesses this response, the NULL dereference occurs, causing a crash of\u003cbr\u003ethe CMP client.\u003cbr\u003e\u003cbr\u003eApplications that process untrusted CMP/CRMF messages may be affected.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\u003cbr\u003eissue, as the affected code is outside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:48:03.405Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d"
        },
        {
          "name": "3.5.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/810b722f772652ad48042bcc7ab07e3414b11d0f"
        },
        {
          "name": "3.4.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/665d5254083affde9982efca7c41dd01cacc8774"
        },
        {
          "name": "3.0.21 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/61a86a8cd73546c9fea916f3d304c1293e05c046"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "NULL Pointer Dereference in CRMF EncryptedValue Decryption",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-42767",
    "datePublished": "2026-06-09T16:03:27.435Z",
    "dateReserved": "2026-04-29T09:22:27.968Z",
    "dateUpdated": "2026-06-10T07:48:03.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42768 (GCVE-0-2026-42768)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-06-10 07:48

Title

Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()

Summary

Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success. An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available. That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it. 2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted. An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle. We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity. To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled. The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key. The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption. The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 19:40 UTC

CWE

CWE-514 - Covert Channel

Assigner

openssl mitre root Scorecard

References

5 references

URL	Tags
https://openssl-library.org/news/secadv/20260609.txt	vendor-advisory
https://github.com/openssl/openssl/commit/f04b377…	patch
https://github.com/openssl/openssl/commit/a2ca7b2…	patch
https://github.com/openssl/openssl/commit/bbb151a…	patch
https://github.com/openssl/openssl/commit/dd68364…	patch

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 4.0.0 , < 4.0.1 (semver) Affected: 3.6.0 , < 3.6.3 (semver) Affected: 3.5.0 , < 3.5.7 (semver) Affected: 3.4.0 , < 3.4.6 (semver)

Date Public

2026-06-09 14:00

Credits

Alex Gaynor (Anthropic) Dmitry Belyavskiy (Red Hat) Alicja Kario (Red Hat)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T19:40:18.647253Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T19:40:22.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor (Anthropic)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dmitry Belyavskiy (Red Hat)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alicja Kario (Red Hat)"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\u003cbr\u003eBleichenbacher-style attack when an attacker is able to provide the CMS or\u003cbr\u003eS/MIME messages and observe the error code and/or decryption output.\u003cbr\u003e\u003cbr\u003eImpact summary: The Bleichenbacher-style attack allows an attacker to use the\u003cbr\u003evictim\u0027s vulnerable application as a way to decrypt or sign messages with the\u003cbr\u003evictim\u0027s private RSA key.\u003cbr\u003e\u003cbr\u003eThe attack is possible in 2 variants.\u003cbr\u003e\u003cbr\u003e1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\u003cbr\u003eproviding the recipient certificate. In this case OpenSSL iterates over every\u003cbr\u003eKeyTransRecipientInfo (KTRI) without stopping at the first success.\u003cbr\u003e\u003cbr\u003eAn attacker who authors a message with two KTRI entries \u2014 the first one\u003cbr\u003ewrapping a real CEK under the victim\u0027s public key, the second with an\u003cbr\u003earbitrary probe ciphertext \u2014 obtains opportunity to iterate the 2nd KTRI to\u003cbr\u003eget a valid PKCS#1 v1.5 padding if the error code of the application is\u003cbr\u003eavailable.\u003cbr\u003e\u003cbr\u003eThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO \u002798): an\u003cbr\u003eadaptive-chosen-ciphertext side channel from which the attacker decrypts any\u003cbr\u003eRSA ciphertext to the victim\u0027s key or forges any PKCS#1 v1.5 signature under\u003cbr\u003eit.\u003cbr\u003e\u003cbr\u003e2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\u003cbr\u003ethe recipient certificate, and the recipient is not found, a random\u003cbr\u003ekey is substituted.\u003cbr\u003e\u003cbr\u003eAn attacker who authors a message and is able to compare both error code and\u003cbr\u003ethe result of the decryption, can mount a Bleichenbacher oracle.\u003cbr\u003e\u003cbr\u003eWe are not aware of any applications that provide a remote attacker\u003cbr\u003ean opportunity to mount an attack described in these scenarios. We consider\u003cbr\u003ethe existence of such application very unlikely, and for this reason this\u003cbr\u003eCVE has been evaluated as Low severity.\u003cbr\u003e\u003cbr\u003eTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\u003cbr\u003einvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\u003cbr\u003ein draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\u003cbr\u003erejection was explicitly disabled.\u003cbr\u003e\u003cbr\u003eThe implicit rejection mechanism always returns a plaintext value,\u003cbr\u003ethe symmetric key. This result is deterministic for the ciphertext and the\u003cbr\u003eprivate key.  The length of the decryption result can happen to match the\u003cbr\u003elength of the key of the symmetric cipher that was used for the content\u003cbr\u003eencryption. When a certificate is not provided, the last RecipientInfo\u003cbr\u003eproducing a key that looks valid will be used. It may cause getting garbage\u003cbr\u003econtent on decryption. As a proper way to deal with this a recipient\u003cbr\u003ecertificate has to be provided to identify the particular RecipientInfo for\u003cbr\u003edecryption.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\u003cbr\u003eCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim\u0027s vulnerable application as a way to decrypt or sign messages with the\nvictim\u0027s private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries \u2014 the first one\nwrapping a real CEK under the victim\u0027s public key, the second with an\narbitrary probe ciphertext \u2014 obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO \u002798): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim\u0027s key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key.  The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-514",
              "description": "CWE-514 Covert Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:48:04.770Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f"
        },
        {
          "name": "3.5.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d"
        },
        {
          "name": "3.4.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/dd68364107a58841c0a2546812518b65d3a23abd"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-42768",
    "datePublished": "2026-06-09T16:03:28.206Z",
    "dateReserved": "2026-04-29T09:22:27.969Z",
    "dateUpdated": "2026-06-10T07:48:04.770Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42769 (GCVE-0-2026-42769)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-06-10 07:48

Title

Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate

Summary

Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate. One of the parts of the Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA) key Rollover, which is sent by the server in a message with type 'id-it-rootCaKeyUpdate'. As part of these messages, 'newWithOld' certificate, the new root CA certificate signed with the old root CA key, is provided, and verifying its signature is crucial for transferring the trust from the old CA key to the new one. The 'id-it-rootCaKeyUpdate' messages are expected to be processed with OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld' certificate. A typo in the certificate chain building code led to adding an incorrect certificate ('newWithOld' instead of 'oldRoot') to the certificate chain, rendering the certificate verification process ineffectual (only the issuer name and the algorithm OIDs were verified by other parts of the verification code). An attacker who already has credentials that satisfy the CMP message protection checks can generate a new key pair and use a crafted self-signed certificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP clients would accept as a new trust anchor. Significant preconditions for the attack (having valid RA-level credentials) are the reason the issue was assigned Low severity. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 19:38 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

openssl mitre root Scorecard

References

5 references

URL	Tags
https://openssl-library.org/news/secadv/20260609.txt	vendor-advisory
https://github.com/openssl/openssl/commit/d531f21…	patch
https://github.com/openssl/openssl/commit/d35cd47…	patch
https://github.com/openssl/openssl/commit/54d0989…	patch
https://github.com/openssl/openssl/commit/777b363…	patch

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 4.0.0 , < 4.0.1 (semver) Affected: 3.6.0 , < 3.6.3 (semver) Affected: 3.5.0 , < 3.5.7 (semver) Affected: 3.4.0 , < 3.4.6 (semver)

Date Public

2026-06-09 14:00

Credits

Alex Gaynor (Anthropic) Alex Gaynor (Anthropic) Bob Beck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T19:38:00.495097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T19:38:05.632Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alex Gaynor (Anthropic)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alex Gaynor (Anthropic)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Bob Beck"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue Summary: An error in the callback used to verify the certificate\u003cbr\u003eprovided in a Root CA key update Certificate Management Protocol (CMP)\u003cbr\u003emessage response rendered the certificate validation ineffectual, which\u003cbr\u003ecould lead to escalation of credentials from the Registration Authority (RA)\u003cbr\u003elevel to the root Certification Authority (root CA) level.\u003cbr\u003e\u003cbr\u003eImpact Summary: The Registration Autority could replace the root CA\u003cbr\u003ecertificate for the CMP clients with an arbitrary root CA certificate.\u003cbr\u003e\u003cbr\u003eOne of the parts of the Certificate Management Protocol (CMP), specified in\u003cbr\u003eRFC 9810, is Root Certification Authority (root CA) key Rollover,\u003cbr\u003ewhich is sent by the server in a message with type \u0027id-it-rootCaKeyUpdate\u0027.\u003cbr\u003eAs part of these messages, \u0027newWithOld\u0027 certificate, the new root CA\u003cbr\u003ecertificate signed with the old root CA key, is provided, and verifying its\u003cbr\u003esignature is crucial for transferring the trust from the old CA key to the\u003cbr\u003enew one.\u003cbr\u003e\u003cbr\u003eThe \u0027id-it-rootCaKeyUpdate\u0027 messages are expected to be processed with\u003cbr\u003eOSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the \u0027newWithOld\u0027\u003cbr\u003ecertificate.  A typo in the certificate chain building code led to adding\u003cbr\u003ean incorrect certificate (\u0027newWithOld\u0027 instead of \u0027oldRoot\u0027) to the\u003cbr\u003ecertificate chain, rendering the certificate verification process ineffectual\u003cbr\u003e(only the issuer name and the algorithm OIDs were verified by other parts\u003cbr\u003eof the verification code).\u003cbr\u003e\u003cbr\u003eAn attacker who already has credentials that satisfy the CMP message\u003cbr\u003eprotection checks can generate a new key pair and use a crafted self-signed\u003cbr\u003ecertificate in its \u0027id-it-rootCaKeyUpdate\u0027 CMP messages which affected CMP\u003cbr\u003eclients would accept as a new trust anchor.\u003cbr\u003e\u003cbr\u003eSignificant preconditions for the attack (having valid RA-level credentials)\u003cbr\u003eare the reason the issue was assigned Low severity.\u003cbr\u003e\u003cbr\u003eThe FIPS modules are not affected by this issue, as the affected code is\u003cbr\u003eoutside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue Summary: An error in the callback used to verify the certificate\nprovided in a Root CA key update Certificate Management Protocol (CMP)\nmessage response rendered the certificate validation ineffectual, which\ncould lead to escalation of credentials from the Registration Authority (RA)\nlevel to the root Certification Authority (root CA) level.\n\nImpact Summary: The Registration Autority could replace the root CA\ncertificate for the CMP clients with an arbitrary root CA certificate.\n\nOne of the parts of the Certificate Management Protocol (CMP), specified in\nRFC 9810, is Root Certification Authority (root CA) key Rollover,\nwhich is sent by the server in a message with type \u0027id-it-rootCaKeyUpdate\u0027.\nAs part of these messages, \u0027newWithOld\u0027 certificate, the new root CA\ncertificate signed with the old root CA key, is provided, and verifying its\nsignature is crucial for transferring the trust from the old CA key to the\nnew one.\n\nThe \u0027id-it-rootCaKeyUpdate\u0027 messages are expected to be processed with\nOSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the \u0027newWithOld\u0027\ncertificate.  A typo in the certificate chain building code led to adding\nan incorrect certificate (\u0027newWithOld\u0027 instead of \u0027oldRoot\u0027) to the\ncertificate chain, rendering the certificate verification process ineffectual\n(only the issuer name and the algorithm OIDs were verified by other parts\nof the verification code).\n\nAn attacker who already has credentials that satisfy the CMP message\nprotection checks can generate a new key pair and use a crafted self-signed\ncertificate in its \u0027id-it-rootCaKeyUpdate\u0027 CMP messages which affected CMP\nclients would accept as a new trust anchor.\n\nSignificant preconditions for the attack (having valid RA-level credentials)\nare the reason the issue was assigned Low severity.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:48:06.084Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/d531f21c0fe99067a66fc0ff1161ef127f9cd70b"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/d35cd473a271bf3ce7bf3d32af53217fb83ae92c"
        },
        {
          "name": "3.5.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/54d0989997e5fc26057009a9782c3441ce3842fb"
        },
        {
          "name": "3.4.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/777b363b16fcf2153bb3ded39dc3838713667c44"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-42769",
    "datePublished": "2026-06-09T16:03:28.999Z",
    "dateReserved": "2026-04-29T09:22:27.969Z",
    "dateUpdated": "2026-06-10T07:48:06.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CERTFR-2026-AVI-1249

Solutions

CVE-2026-42501 (GCVE-0-2026-42501)

CVE-2026-42504 (GCVE-0-2026-42504)

CVE-2026-42505 (GCVE-0-2026-42505)

CVE-2026-42507 (GCVE-0-2026-42507)

CVE-2026-42508 (GCVE-0-2026-42508)

CVE-2026-42764 (GCVE-0-2026-42764)

CVE-2026-42766 (GCVE-0-2026-42766)

CVE-2026-42767 (GCVE-0-2026-42767)

CVE-2026-42768 (GCVE-0-2026-42768)

CVE-2026-42769 (GCVE-0-2026-42769)

Tags

Sightings

Nomenclature

Related by attack behaviour